Vulnerability Assessment & Penetration Testing (VAPT) Engineer

Nexus Recruitment Group; Taguig; On-site; PHP 1,200,000 - 1,900,000; Full time

Job summary

Nexus Recruitment Group is seeking a highly skilled Vulnerability Assessment & Penetration Testing (VAPT) Engineer to lead and perform security testing of enterprise applications, platforms, and systems. The role demands deep expertise in web app testing, common VAPT tools, and clear communication of findings to both technical and non-technical stakeholders.

Responsibilities include conducting manual/automated tests on web apps, cloud platforms, APIs, and internal systems; documenting

Qualifications

• At least 5 years of hands-on experience in web application penetration testing and vulnerability assessments in large-scale enterprise environments.
• Experience using Burp Suite and AppScan (preferred) or Nessus, Nipper, Trustwave.
• Strong knowledge of OWASP Top 10, SANS/CWE vulnerabilities, and secure coding principles.
• Deep understanding of attack vectors, threat modeling, and exploitation techniques across web, API, and system layers.
• Excellent technical reporting and communication skills, with the ability to translate complex findings for business and technical audiences.

Responsibilities

• Conduct manual and automated penetration tests on web applications, cloud platforms, APIs, and internal systems.
• Identify, assess, and document security vulnerabilities, working closely with application and infrastructure teams to validate and prioritize remediation.
• Serve as a subject matter expert (SME) for the firms VAPT function, contributing to strategy, standards, and testing methodologies.
• Manage and maintain key VAPT tools and platforms (e.g., Burp Suite, AppScan, Nessus, Nipper, Trustwave).
• Deliver clear, well-structured reports that include actionable recommendations aligned with security best practices and risk management principles.
• Collaborate with internal stakeholders across IT, DevOps, and InfoSec teams to enhance secure development practices and build threat awareness.
• Stay current on emerging security threats, techniques, and tools to continuously improve VAPT effectiveness.

Skills

web application penetration testing

vulnerability assessments

SME for VAPT

Tools

Burp Suite

AppScan

Nessus

Nipper

Trustwave

Job description

Vulnerability Assessment & Penetration Testing (VAPT) Engineer

Job Openings Vulnerability Assessment & Penetration Testing (VAPT) Engineer

About the job Vulnerability Assessment & Penetration Testing (VAPT) Engineer

Job Summary:

We are seeking a highly skilled VulnerabilityAssessment & Penetration (VAPT) Engineer to lead and perform technical security testing of the firms enterprise applications, platforms, and systems. This role is a critical part of the global cybersecurity function, ensuring that vulnerabilities are identified, reported, and addressed in a timely, risk-informed manner. The successful candidate will bring deep expertise in web application penetration testing, mastery of common VAPT tools, and the ability to communicate technical findings effectively to both technical and non-technical audiences.

Key Responsibilities:

• Conduct manual and automated penetration tests on web applications, cloud platforms, APIs, and internal systems.
• Identify, assess, and document security vulnerabilities, working closely with application and infrastructure teams to validate and prioritize remediation.
• Serve as a subject matter expert (SME) for the firms VAPT function, contributing to strategy, standards, and testing methodologies.
• Manage and maintain key VAPT tools and platforms (e.g., Burp Suite, AppScan, Nessus, Nipper, Trustwave).
• Deliver clear, well-structured reports that include actionable recommendations aligned with security best practices and risk management principles.
• Collaborate with internal stakeholders across IT, DevOps, and InfoSec teams to enhance secure development practices and build threat awareness.
• Stay current on emerging security threats, techniques, and tools to continuously improve VAPT effectiveness.

Qualifications:

• At least 5 years of hands-on experience in web application penetration testing and vulnerability assessments in large-scale enterprise environments.
• Proven experience using at least two of the following tools: Burp Suite, AppScan, Nessus, Nipper, Trustwave(strong preference for Burp Suite and AppScan).
• Strong knowledge of OWASP Top 10, SANS/CWE vulnerabilities, and secure coding principles.
• Deep understanding of attack vectors, threat modeling, and exploitation techniques across web, API, and system layers.
• Excellent technical reporting and communication skills, with the ability to translate complex findings for business and technical audiences.

Certifications:

• Preferred: CISSP (Certified Information Systems Security Professional)

Preferred Skills:

• Experience in professional services or highly regulated industries (e.g., legal, finance, or healthcare).
• Familiarity with secure SDLC integration, CI/CD security testing, or DevSecOps practices is a plus.
• Ability to work across cultures and time zones in a global team environment.