VAPT Analyst

PM Consulting; Pasig; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

PM Consulting is seeking a Vulnerability Assessment and Penetration Testing (VAPT) Specialist to conduct security testing on web and mobile applications and identify weaknesses.

You will document findings, assess risk using OWASP Top 10 guidance, and prepare remediation recommendations for stakeholders.

The role requires hands-on testing with tools like Burp Suite, Kali Linux, Nessus, and ZAP, plus clear reporting and collaboration with development teams.

Qualifications

• Bachelor’s degree in Information Technology or related four-year course.
• Minimum of 3 years of hands-on VAPT experience for web and mobile applications.
• Experience applying OWASP Top 10 during security testing.
• Proficiency with security testing tools and reporting.
• Certifications such as CEH or CISSP preferred but not required.

Responsibilities

• Perform vulnerability assessments and penetration testing on web and mobile applications.
• Execute testing activities in alignment with established security testing frameworks (e.g., OWASP Top 10).
• Prepare comprehensive assessment reports outlining identified vulnerabilities, risk ratings, and remediation recommendations.
• Customize reporting formats when required by internal stakeholders.
• Provide advisory support and technical guidance to development and remediation teams.
• Facilitate meetings or consultation sessions to ensure timely completion of testing activities and remediation follow-ups.
• Independently manage assigned tasks, schedules, and security testing tickets.
• Submit regular progress updates to immediate supervisors.
• Maintain strict confidentiality of sensitive information and assessment results at all times.

Skills

VAPT

Security testing

OWASP Top 10

Report writing

Communication

Education

Bachelor’s degree in Information Technology or related four-year course

Tools

Kali Linux

Metasploit

Qualys

Nessus

Burp Suite

OWASP ZAP

Job description

We are seeking a Vulnerability Assessment and Penetration Testing (VAPT) Specialist to conduct security testing on web and mobile applications. This role is responsible for identifying security weaknesses, documenting findings, and supporting remediation efforts to strengthen application security posture.

The ideal candidate has hands-on experience performing structured security assessments aligned with recognized industry frameworks and can clearly communicate technical findings to both technical and non-technical stakeholders.

Key Responsibilities

• Perform vulnerability assessments and penetration testing on web and mobile applications.
• Execute testing activities in alignment with established security testing frameworks (e.g., OWASP Top 10).
• Prepare comprehensive assessment reports outlining identified vulnerabilities, risk ratings, and remediation recommendations.
• Customize reporting formats when required by internal stakeholders.
• Provide advisory support and technical guidance to development and remediation teams.
• Facilitate meetings or consultation sessions to ensure timely completion of testing activities and remediation follow-ups.
• Independently manage assigned tasks, schedules, and security testing tickets.
• Submit regular progress updates to immediate supervisors.
• Maintain strict confidentiality of sensitive information and assessment results at all times.

Qualifications

Education

Bachelor’s degree in Information Technology or any related four-year course.

Experience

• Minimum of 3 years of hands-on experience conducting web and mobile application VAPT engagements.
• Demonstrated experience applying the OWASP Top 10 framework during security testing.
• Technical Skills
• Practical experience using both open-source and commercial security testing tools, such as Kali Linux, Metasploit, Qualys, Nessus, Burp Suite, OWASP ZAP, and similar platforms.
• Working knowledge of web and mobile application development concepts.
• Strong report-writing skills, with the ability to present technical findings in a clear and understandable manner for diverse audiences.
• Certifications (Preferred but Not Required): Relevant c ybersecurity certifications such as CEH, CISSP, or equivalent.