VAPT Engineer – Enterprise & Scalable Platforms (Onsite, Karachi, PKR Salary)

hr-pod-hiring-talent-globally; Karachi Division; On-site; PKR 1,800,000 - 2,400,000; Full time

Job summary

hr-pod-hiring-talent-globally is seeking an experienced VAPT security specialist to lead engagements across web, API, mobile, and infrastructure. You will plan, execute, and document findings with clear severity, business impact, and remediation guidance.

You will collaborate with engineering, DevOps, QA, and product teams, review authentication and session management, assess AWS cloud configurations, and contribute to secure SDLC practices while maintaining strict ethical standards.

Qualifications

• 2–5 years of experience in VAPT, application security, cybersecurity, or a related role, with a hands-on understanding of the OWASP Top 10 and API security risks.
• Experience with web, API, mobile, and infrastructure security testing, with familiarity with tools such as Burp Suite, Nmap, Nessus, OWASP ZAP, or equivalent.
• Strong understanding of Linux, networking, HTTP, authentication, and common security controls.
• Strong reporting, documentation, and communication skills.
• Relevant certifications such as OSCP, CEH, eJPT, Security+, or equivalent.
• Cloud security experience, particularly AWS.
• Experience with OTT, high-traffic platforms, streaming ecosystems, or enterprise SaaS.
• Knowledge of threat modeling and secure code review.
• Ability to ensure that all testing is authorized, documented, and conducted within the approved scope, with strong ethical and confidentiality standards.
• Ability to explain technical findings clearly to both technical and non-technical stakeholders.
• Proactive approach to reducing security risks and validating remediation.

Responsibilities

• Plan and execute approved VAPT engagements for web applications, APIs, mobile applications, and infrastructure.
• Assess authentication, authorization, session management, input validation, and common application vulnerabilities.
• Perform API security testing and review security controls for platform integrations.
• Support mobile application security testing across iOS and Android.
• Assess cloud and infrastructure configurations across AWS.
• Document findings with clear severity, business impact, evidence, and remediation guidance.
• Collaborate with engineering, DevOps, QA, and product teams to support remediation.
• Conduct retesting and validate that identified vulnerabilities have been resolved.
• Support secure SDLC practices, security awareness, and vulnerability management reporting.

Job description

Requirements:

• 2–5 years of experience in VAPT, application security, cybersecurity, or a related role, with a hands-on understanding of the OWASP Top 10 and API security risks.


• Experience with web, API, mobile, and infrastructure security testing, with familiarity with tools such as Burp Suite, Nmap, Nessus, OWASP ZAP, or equivalent.


• Strong understanding of Linux, networking, HTTP, authentication, and common security controls.


• Strong reporting, documentation, and communication skills.


• Relevant certifications such as OSCP, CEH, eJPT, Security+, or equivalent.


• Cloud security experience, particularly AWS.


• Experience with OTT, high-traffic platforms, streaming ecosystems, or enterprise SaaS.


• Knowledge of threat modeling and secure code review.


• Ability to ensure that all testing is authorized, documented, and conducted within the approved scope, with strong ethical and confidentiality standards.


• Ability to explain technical findings clearly to both technical and non-technical stakeholders.


• Proactive approach to reducing security risks and validating remediation.

Responsibilities:

• Plan and execute approved VAPT engagements for web applications, APIs, mobile applications, and infrastructure.


• Assess authentication, authorization, session management, input validation, and common application vulnerabilities.


• Perform API security testing and review security controls for platform integrations.


• Support mobile application security testing across iOS and Android.


• Assess cloud and infrastructure configurations across AWS and related environments.


• Document findings with clear severity, business impact, evidence, and remediation guidance.


• Collaborate with engineering, DevOps, QA, and product teams to support remediation.


• Conduct retesting and validate that identified vulnerabilities have been resolved.


• Support secure SDLC practices, security awareness, and vulnerability management reporting.