VAPT engineer

'

: - ( - )

Experience: 9+ yrs

Location: Hyderabad

As a VAPT Engineer, you will be responsible for designing, executing, and reporting on comprehensive vulnerability assessment and penetration testing engagements across cloud, web, mobile, and network environments. Leveraging your expertise in Automated Security Reconnaissance (ASR) frameworks, you will uncover hidden attack vectors and validate zero-day exploits, ensuring that all findings are actionable and align with industry best practices. Your role will also involve collaborating with development and security teams to remediate identified risks, maintain threat intelligence feeds, and contribute to the evolution of the organization’s security posture. You will serve as a trusted advisor in the continuous improvement of security controls, delivering insights that influence product design, architecture resilience, and overall cyber risk strategy.

Requirements

• Conduct full-stack vulnerability assessments and penetration tests on web applications, microservices, APIs, and network infrastructure.
• Implement and customize Automated Security Reconnaissance (ASR) tools to accelerate threat surface analysis and discovery.
• Perform advanced Red Team exercises, simulating realistic adversary tactics, techniques, and procedures (TTPs) to evaluate detection and response capabilities.
• Analyze and interpret vulnerability scan results, prioritizing findings based on risk and business impact.
• Develop detailed exploitation proof-of-concepts (POCs) and provide actionable remediation guidance to stakeholders.
• Collaborate with DevSecOps teams to integrate security testing into CI/CD pipelines and development workflows.
• Mentor junior security analysts, conducting training sessions on vulnerability tools, exploitation techniques, and secure coding practices.
• Maintain up-to-date knowledge of emerging threats, exploits, and security frameworks, updating testing methodologies accordingly.
• Generate comprehensive reports and executive summaries that translate technical findings into clear, business-relevant insights.
• Participate in incident response drills, providing expertise on breach containment, forensic analysis, and post-incident remediation.
• 9+ years of hands-on experience in vulnerability assessment, penetration testing, and red teaming across diverse technology stacks.
• Deep expertise in Automated Security Reconnaissance (ASR) tools such as Burp Suite, Zap, and custom scripting.
• Proficiency in exploiting web application vulnerabilities (SQLi, XSS, CSRF, OTN, SSRF) and infrastructure weaknesses (misconfigurations, privilege escalation).
• Advanced knowledge of OWASP ASVS, NIST SP 800-53, and CIS Controls, with proven ability to map findings to industry standards.
• Strong programming prowess in Python, Bash, PowerShell, and scripting for automation and exploitation.
• Excellent communication skills, able to translate complex technical concepts to non-technical audiences and produce clear, actionable reports.
• Experience in Red Team simulations, including threat modeling, attack choreography, and adversary emulation frameworks such as MITRE ATT&CK.
• Demonstrated success in integrating security testing into CI/CD pipelines and SecOps workflows.
• A proactive, continuous learning mindset with active participation in security communities, capture-the-flag events, and vulnerability research.
• A proven track record of mentoring junior analysts and fostering a collaborative security culture.