Job Summary

We are looking for an experienced Security Analyst with 4–5 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, Android applications (APK), iOS applications (IPA), and IT infrastructure.

The candidate should have strong expertise in identifying, validating, exploiting, and documenting security vulnerabilities across different technology stacks. The ideal candidate must be capable of independently executing penetration tests, assessing business impact, recommending effective remediation measures, and preparing comprehensive technical and executive-level reports.

The candidate should have a strong understanding of OWASP security standards, manual testing methodologies, penetration testing tools, and security assessment frameworks.

Key Responsibilities

1. Web Application Penetration Testing

• Perform manual and automated penetration testing of web applications to identify security vulnerabilities.
  

• Assess applications against the OWASP Top 10 and OWASP Web Security Testing Guide.
  

• Identify and validate vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Broken Access Control, IDOR/BOLA, authentication and authorization flaws, CSRF, file upload vulnerabilities, path traversal, command injection, and business logic vulnerabilities.
  

• Test session management, password policies, account lockout, MFA implementation, password reset functionality, and authentication mechanisms.
  

• Assess security headers, cookie attributes, CORS policies, TLS configuration, and sensitive information exposure.
  

• Perform role-based access control testing, privilege escalation testing, and horizontal and vertical access control assessments.
  

• Identify vulnerabilities in application workflows, business logic, and multi-step transactions.
  

• Manually validate scanner findings to eliminate false positives and identify vulnerabilities that automated tools may miss.
  

2. API Security Testing

• Conduct penetration testing of REST, SOAP, GraphQL, and other API implementations.
  

• Test APIs for authentication and authorization weaknesses, Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA), and excessive data exposure.
  

• Assess API endpoints for injection attacks, mass assignment, improper input validation, rate-limiting weaknesses, and business logic vulnerabilities.
  

• Test JWT implementation, OAuth 2.0, OpenID Connect, API keys, access tokens, refresh tokens, and session handling.
  

• Evaluate API security controls, including CORS, HTTP methods, request validation, error handling, and sensitive data transmission.
  

• Test for unrestricted resource consumption, replay attacks, and abuse of business-critical API functionality.
  

• Review API specifications, including Swagger/OpenAPI documentation, to identify undocumented or improperly secured endpoints.
  

• Prepare detailed findings with reproducible proof of concept, impact analysis, and remediation recommendations.
  

3. Android Application Security Testing (APK)

• Perform static and dynamic security assessments of Android applications.
  

• Analyze APK files using tools such as MobSF, JADX, apktool, and Android Debug Bridge (ADB).
  

• Identify hardcoded credentials, API keys, secrets, insecure local storage, improper cryptographic implementations, and sensitive information leakage.
  

• Test insecure inter-process communication, exported activities and services, content providers, broadcast receivers, and deep links.
  

• Assess certificate validation, TLS implementation, WebView security, root detection, and application tampering protections.
  

• Test authentication, authorization, session management, and business logic within mobile applications.
  

• Analyze application network traffic using Burp Suite or equivalent proxy tools.
  

• Assess local databases, shared preferences, files, logs, backups, and cached application data for sensitive information exposure.
  

• Identify risks associated with insecure permissions, intent handling, and improper platform security configurations.
  

4. iOS Application Security Testing (IPA)

• Conduct static and dynamic security assessments of iOS applications.
  

• Analyze IPA packages, application binaries, entitlements, property list files, and application configurations.
  

• Use tools such as MobSF, Frida, objection, Burp Suite, and suitable iOS analysis utilities.
  

• Assess insecure storage of sensitive information in Keychain, local files, databases, logs, and application caches.
  

• Test ATS configuration, TLS certificate validation, URL schemes, Universal Links, and WebView security.
  

• Identify hardcoded secrets, insecure cryptographic implementations, improper authentication, and authorization weaknesses.
  

• Assess jailbreak detection, runtime manipulation resistance, and application tampering protections where applicable.
  

• Perform runtime instrumentation and dynamic analysis on authorized test devices or emulators.
  

• Test mobile application API communications and validate server-side authorization controls.
  

5. Internal and External Infrastructure Penetration Testing

• Conduct internal and external infrastructure vulnerability assessments and penetration tests across servers, endpoints, network devices, VPNs, and exposed services.
  

• Perform network discovery, port scanning, service enumeration, operating system identification, and vulnerability validation.
  

• Assess Windows and Linux systems, Active Directory environments, domain controllers, and common enterprise services.
  

• Identify and validate vulnerabilities arising from outdated software, insecure configurations, weak authentication, excessive privileges, and exposed services.
  

• Perform Active Directory security assessments covering Kerberoasting exposure, weak service account configurations, excessive privileges, insecure delegation, and common privilege escalation paths.
  

• Assess SMB, SSH, RDP, LDAP, DNS, FTP, VPN, and other network services for security weaknesses.
  

• Validate patch management, insecure protocols, password policies, access controls, and system hardening configurations.
  

• Assess firewall rules, network segmentation, externally exposed services, and opportunities for unauthorized access.
  

• Perform controlled exploitation and privilege escalation testing within the agreed scope and rules of engagement.
  

• Use vulnerability scanners such as Nessus, Qualys, or equivalent tools, followed by manual verification and risk prioritization.
  

• Document attack paths and explain the business impact of identified weaknesses.
  

6. Reporting and Remediation Validation

• Prepare comprehensive VAPT reports with executive summaries, technical findings, severity ratings, proof of concept, affected assets, impact, and remediation recommendations.
  

• Classify vulnerabilities using CVSS and business context to support appropriate risk prioritization.
  

• Provide clear, actionable remediation guidance to development, infrastructure, and security teams.
  

• Conduct retesting to validate remediation and confirm whether identified vulnerabilities have been effectively addressed.
  

• Maintain accurate assessment evidence, testing notes, screenshots, request/response data, and vulnerability registers.
  

• Participate in client discussions, technical walkthroughs, and remediation review meetings.
  

• Ensure assessments comply with approved scopes, rules of engagement, confidentiality requirements, and responsible testing practices.
  

7. Security Standards and Methodologies

• Apply OWASP Top 10, OWASP API Security Top 10, OWASP Web Security Testing Guide, OWASP Mobile Application Security Testing Guide (MASTG), and Mobile Application Security Verification Standard (MASVS).
  

• Follow PTES, NIST SP 800-115, and other relevant penetration testing methodologies.
  

• Understand CVSS scoring, CWE classifications, vulnerability lifecycle management, and risk-based remediation.
  

• Maintain awareness of current exploitation techniques, emerging vulnerabilities, and application and infrastructure security trends.
  

Required Technical Skills

Application Security

• Strong manual web application and API penetration testing skills.
  

• Practical understanding of authentication, authorization, access control, session management, and business logic testing.
  

• Experience with REST APIs, JSON, HTTP/HTTPS, JWT, OAuth 2.0, and common API security controls.
  

Mobile Application Security

• Hands-on experience testing Android APK and iOS IPA applications.
  

• Familiarity with static analysis, dynamic analysis, runtime instrumentation, mobile traffic interception, and application reverse engineering.
  

Infrastructure Security

• Strong understanding of TCP/IP, networking, Windows and Linux security, Active Directory, and common network services.
  

• Experience with internal and external penetration testing, privilege escalation, service enumeration, and security configuration reviews.
  

Tools

• Burp Suite Professional or equivalent web application testing tools.
  

• Nmap, Nessus, Qualys, or equivalent vulnerability assessment tools.
  

• MobSF, JADX, apktool, ADB, Frida, and objection.
  

• Impacket, NetExec, BloodHound, enum4linux-ng, and other authorized infrastructure assessment tools.
  

• Linux-based penetration testing environments and scripting utilities.
  

Scripting and Development Knowledge

• Working knowledge of Python, Bash, or PowerShell for automation and security testing.
  

• Understanding of JavaScript, SQL, HTTP, JSON, and common web application architectures.
  

• Ability to analyze application requests, responses, code snippets, and technical configurations.
  

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
  

• 4–5 years of hands-on experience in VAPT and security assessments.
  

• Relevant certifications such as OSCP, PNPT, eWPT, eMAPT, CEH Practical, or equivalent are desirable.
  

• Strong analytical, problem-solving, technical documentation, and communication skills.
  

• Ability to work independently, manage assessment timelines, and interact professionally with clients and internal technical teams.
  

Expected Candidate Capabilities

The candidate must be capable of:

• Independently executing web, API, Android, iOS, and infrastructure penetration tests.
  

• Performing manual validation beyond automated scanner output.
  

• Demonstrating vulnerabilities safely using reproducible proof of concept.
  

• Identifying attack chains and explaining realistic security and business impact.
  

• Producing high-quality VAPT reports with actionable remediation guidance.
  

• Conducting remediation retesting and communicating findings to technical stakeholders.
  

• Managing multiple assessments while maintaining quality, confidentiality, and adherence to scope.
  

Key Performance Indicators (KPIs)

• Quality, accuracy, and completeness of VAPT reports.
  

• Effectiveness of manual vulnerability discovery and validation.
  

• Reduction of false positives and duplicate findings.
  

• Timely completion of assigned assessments.
  

• Quality of proof of concept and remediation recommendations.
  

• Effectiveness of remediation retesting.
  

• Compliance with testing methodology, scope, and evidence requirements.
  

Note: Candidates must have genuine hands-on experience in manual penetration testing across application, API, mobile, and infrastructure environments. Experience limited to running automated vulnerability scanners without independently validating findings will not meet the requirements of this role.