Security Analyst – VAPT & Penetration Testing

BAE Systems; Doha; On-site; QAR 180,000 - 300,000; Full time

Job summary

BAE Systems is seeking a seasoned VAPT specialist to conduct comprehensive penetration testing and vulnerability assessments across enterprise networks, cloud platforms and applications. You will validate findings, perform controlled exploits, and help remediate security weaknesses with a structured reporting approach.

The role requires hands-on testing across diverse environments, including web, API and infrastructure security, with strong OWASP, SAST/DAST and security automation experience.

Qualifications

• Experience performing vulnerability assessments and penetration testing across diverse environments.
• Strong knowledge of OWASP Top 10 and secure coding practices.
• Familiarity with SAST/DAST and cloud/server infrastructure security testing.

Responsibilities

• Conduct internal and external penetration testing across networks, servers, firewalls, endpoints and infrastructure.
• Perform web application and API penetration testing, including OWASP vulnerabilities.
• Validate vulnerabilities and false positives; conduct controlled exploitation to assess impact.
• Test network devices, firewalls, routers, switches, VPNs, load balancers and servers.
• Assess application security including authentication, authorization, session management and input validation.
• Review source code for security issues and support SAST/DAST activities.
• Evaluate security of cloud environments and operating systems.
• Prepare reports with evidence, risk ratings and remediation guidance.
• Work with teams to remediate findings and perform retesting after fixes.
• Follow established penetration-testing methodologies and best practices.

Skills

VAPT

Network Penetration Testing

Web Application Pen Testing

API Security Testing

Infrastructure Security Testing

Cloud Security Testing

Vulnerability Exploitation & Val

OWASP Top 10

SAST & DAST

Source-Code Security Analysis

Secure Coding Practices

Network & Operating System Security

Python/Security Automation

Tools

Burp Suite

Nmap

Nessus

Metasploit

Wireshark

Kali Linux

Python

Job description

The candidate will be responsible for conducting comprehensive Vulnerability Assessment and Penetration Testing (VAPT) across enterprise IT environments, applications, networks, infrastructure, cloud platforms and security systems.

Key Responsibilities

• Conduct internal and external penetration testing across networks, servers, firewalls, endpoints and infrastructure.
• Perform web application and API penetration testing, including testing against OWASP vulnerabilities.
• Conduct vulnerability assessments and manually validate identified vulnerabilities and false positives.
• Perform controlled exploitation to determine the actual impact and severity of identified security weaknesses.
• Conduct security testing of network devices, firewalls, routers, switches, VPNs, load balancers and servers.
• Perform application security testing covering authentication, authorization, session management, input validation, encryption and business-logic vulnerabilities.
• Conduct source-code security reviews and support SAST/DAST activities.
• Assess security of cloud environments and operating systems.
• Perform security assessments using tools such as Burp Suite, Nmap, Nessus, Metasploit, Wireshark and Kali Linux.
• Develop or automate penetration-testing/security activities using Python.
• Prepare detailed penetration-testing and vulnerability-assessment reports containing evidence, risk ratings, business impact and remediation recommendations.
• Work with technical teams to remediate identified vulnerabilities.
• Conduct retesting and validation after remediation.
• Follow established penetration-testing methodologies and cybersecurity best practices.
• Support security teams in identifying attack vectors and improving the organization’s overall security posture.

Required Technical Skills

Strong hands-on knowledge of:

• Vulnerability Assessment & Penetration Testing (VAPT)
• Network Penetration Testing
• Web Application Penetration Testing
• API Security Testing
• Infrastructure Security Testing
• Cloud Security Testing
• Vulnerability Exploitation & Validation
• OWASP Top 10
• SAST & DAST
• Source-Code Security Analysis
• Secure Coding Practices
• Network & Operating System Security
• Python/Security Automation
• Burp Suite
• Nmap
• Nessus
• Metasploit
• Wireshark
• Kali Linux

Requirements

Standards / Framework Knowledge

The candidate should have good knowledge of relevant cybersecurity standards and methodologies, including:

• OWASP
• NIST
• ISO/IEC 27001
• PCI DSS
• Penetration-testing methodologies and security best practices