VAPT Engineer

Hammerjack Pty Ltd; Philippines; On-site; PHP 670,000 - 781,000; Full time

Job summary

Hammerjack Pty Ltd in the Philippines is seeking a seasoned VAPT Engineer to identify and assess security vulnerabilities across web and mobile applications, APIs, networks, cloud environments, and infrastructure through manual and automated testing. You will conduct vulnerability assessments, perform manual testing, report findings, and collaborate with development teams to validate fixes and re-test.

The role requires strong knowledge of OWASP Top 10, tools like Burp Suite, Nmap, Metasploit,

Qualifications

• 3+ years of vulnerability assessment, scanning, and penetration testing of web/mobile apps, APIs, and networks.
• Strong knowledge of OWASP Top 10, web/API security, and cloud security.
• Hands-on experience with Burp Suite, Nmap, Metasploit, Nessus, Wireshark, and OpenVAS.

Responsibilities

• Conduct VAPT across applications, APIs, networks, and cloud environments.
• Perform manual testing, vulnerability analysis, exploit validation, and security assessments.
• Identify vulnerabilities and provide actionable remediation recommendations.
• Prepare technical reports and executive summaries.
• Collaborate with development/infrastructure teams to validate fixes and re-testing.

Skills

VAPT

OWASP Top10

Penetration testing

Web security

API security

Cloud security

Network security

Security reporting

CI/CD security

Python scripting

Tools

Burp Suite

Nmap

Metasploit

Nessus

Wireshark

OpenVAS

Job description

VAPT Engineer (Vulnerability Assessment & Penetration Testing)

SALARY OFFER: PHP 60,000 - PHP 70,000

About the Role

We are looking for a skilled VAPT Engineer to identify and assess security vulnerabilities across web/mobile applications, APIs, networks, cloud environments, and infrastructure through manual and automated security testing.

Key Responsibilities

• Conduct Vulnerability Assessment and Penetration Testing (VAPT) across applications, APIs, networks, and cloud environments.
• Perform manual testing, vulnerability analysis, exploit validation, and security assessments.
• Identify vulnerabilities and provide actionable remediation recommendations.
• Prepare technical reports and executive summaries.
• Collaborate with development/infrastructure teams to validate security fixes and conduct re-testing.
• Stay updated on emerging threats, attack techniques, and security tools.
• Support security audits, compliance, and other cybersecurity initiatives.

Qualifications & Required Skills

• 3+ years of experience in vulnerability assessment, scanning, and penetration testing of websites, cloud applications, APIs, and networks.
• Strong knowledge of OWASP Top 10, web/API security, network security, authentication/authorization, mobile security, and session management.
• Hands-on experience with Burp Suite, Nmap, Metasploit, Nessus, Wireshark, and OpenVAS.
• Knowledge of Linux and Windows environments.
• Scripting experience using Python, Bash, or PowerShell.
• Knowledge of secure coding, DevSecOps, CI/CD security, and secure SDLC.
• Experience with manual penetration testing, exploit validation, and modifying/compiling exploit code.
• Strong technical documentation and reporting skills.
• Exposure to Bug Bounty, CTF, or other ethical hacking/security competitions.

Preferred Qualifications

• Certifications such as OSCP, CEH, eJPT, GWAPT, CISSP, SANS, or GXPN.
• Experience in mobile application security, cloud security, Red Team activities, source code review, and DevSecOps.
• Experience in fintech, banking, or digital wallet applications.
• Knowledge of security/compliance frameworks.
• Experience in high-availability production environments with strict SLA requirements.