Walk-in | VAPT Engineer - DM, Manager

Deloitte Shared Services India; Mumbai; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

Deloitte Shared Services India is seeking an experienced cybersecurity professional in Mumbai to drive security assessments across networks, applications, APIs and cloud environments. You will perform AI security testing, guardrail validation, and vulnerability management, while guiding remediation with clients.

The role requires strong scripting skills and familiarity with OWASP, CIS, and NIST standards, with the ability to explain complex risks clearly.

Qualifications

• 7+ years of experience in cyber security domain.
• Understanding of basic business and information technology management processes.
• Good knowledge of TCP/IP and networks, including firewall and IDS/IPS, routers and switches.
• Experience in Web Application Security Testing, Infrastructure VAPT, API testing.
• Experience in Mobile Security Testing (iOS and Android).
• Experience in Cloud security with AWS and Azure configuration and red teaming.
• Knowledge of AI/LLM penetration testing for Generative AI apps and AI-powered chatbots.
• Understanding of AI security risks including prompt injection and insecure output handling.
• Ability to identify AI security vulnerabilities and recommend remediation.
• Experience in firewall and network device configuration reviews and platform hardening.
• Familiar with OWASP, CIS, NIST ISO/IEC 17799 standards.

Responsibilities

• Lead cybersecurity engagements drawing on 7+ years of experience.
• Assess business and IT processes to align security controls.
• Perform security testing across networks, apps, APIs, and cloud.
• Conduct AI/ML security testing and guardrail assessment.
• Review firewall and network device configurations for risk.
• Utilize Burp Suite, Nessus, and other tools for vulnerability scans.
• Develop scripts for automation and data analysis in Python/Perl.
• Advise remediation plans and communicate risk to clients.

Skills

Cyber security

IT governance

Network security

Web app security

VAPT

Mobile security

Cloud security

AI/LLM security

Threat modeling

Vulnerability management

Scripting

Tools

Burp Suite

Kali Linux

Acunetix

AppScan

Nexpose

Qualys Guard

Nessus

Nmap

Metasploit

Fortify

Python

Perl

Job description

Key Responsibilities

• Total 7+ years of experience in Cyber security domain
• Understanding of basic business and information technology management processes.
• Good knowledge of TCP/ IP and Networks including Firewall, IDS/IPS, Routers, Switches, and network architecture.
• Experience of Web Application Security Testing, Infrastructure VAPT, API testing.
• Experience on Mobile Security Pen-Testing (iOS and Android).
• Experience on Cloud (AWS & Azure) Configuration and Red Teaming.
• Knowledge of AI/LLM penetration testing for Generative AI applications, AI-powered chatbots, and LLM-integrated solutions.
• Understanding of AI-specific security risks, including Prompt Injection, Jailbreaking, Sensitive Information Disclosure, Insecure Output Handling, and excessive agency, aligned with OWASP Top 10 for LLM Applications.
• Ability to identify and validate AI security vulnerabilities, assess potential exploitation scenarios, and recommend effective remediation measures.
• Experience in conducting Firewall and Network Devices Configuration Review and configuration reviews of Windows, Linux, UNIX, Solaris, Databases, etc.
• Experience with Vulnerability Management and Penetration testing tools: Burp suite, Kali Linux, Acunetix, AppScan, Nexpose, Qualys Guard, Nessus, Nmap, Metasploit, Fortify etc.
• Experience in basic scripting such as: Shell, Python, PERL, etc.
• Basic knowledge of Technoilogies such as: IPSEC, SSL, SSH, VPN, Ethernet Token Ring, WAP, SMTP, FTP, Frame Relay, WAN, ATM, FDDI, DSL, ISDN, HP Openview, Sun NetManage, Cisco Works, Radius, Big Brother, F5.

Additional Skills

• Experience on Source Code Review.
• Experience on Network Security Architecture Review, End Point Security, Product Security.
• Experience in security testing of RAG (Retrieval-Augmented Generation) applications, AI guardrails, model access controls, and AI application integrations.
• Strong knowledge on Malware Analysis, Patch Management, Threat Profiling, Container, Dockers.
• Strong analytical and communication skills (written, verbal and presentation)
• Open to learn new tools and technologies as per the project requirement
• Interactive with team members and confident during client meetings, under the guidance of senior members of the project
• Initiative & drive
• Be deadline-oriented and quality-focused
• Familiarity with industry standards and frameworks such as OWASP, CIS, NIST ISO/IEC 17799, etc.
• Demonstrates basic knowledge of security and privacy controls and risk management processes
• Demonstrates basic knowledge in one or more Cyber Threat Management domains such as: Threat Management, Cyber Operations/Fusion Managed Services, Malware Analysis, Collective Threat Intelligence and Cyber Risk Sciences, Incident Management and Forensics, Data Protection solutions.

Preferred qualifications

• Relevant certifications such as OSCP, CRTP, CEH, eWPT, GPEN, Burp Suite Certified Practitioner, cloud security certifications (AWS/Azure/GCP), or equivalent certifications will be an added advantage.