T&T | Cyber: D&R | Assistant Manager | Application & API Security (VAPT) | Bengaluru
•Job requisition ID : 114195
•Location : Bengaluru
•Entity : Deloitte Touche Tohmatsu India LLP
The team
Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity
Your work profile
We are looking for an experienced Assistant Manager - Application & API VAPT with 4-7 years of hands-on penetration testing experience to lead application security assessments, mentor team members, and manage customer engagements. The candidate should possess strong technical expertise in offensive security, application penetration testing, API security testing, and vulnerability management while being capable of driving security initiatives and stakeholder communications.
Technical Responsibilities
•Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for:
•Web Applications
•APIs (REST, SOAP, GraphQL)
•Mobile Applications (iOS & Android)
•Cloud-hosted Applications
•Microservices-based Architectures
•Execute advanced penetration testing techniques to identify and exploit:
•Conduct manual penetration testing beyond automated scanner findings.
•Perform threat modeling and attack surface analysis.
•Validate vulnerabilities identified through SAST, DAST, and SCA tools.
•Conduct secure architecture and security design reviews.
•Perform cloud application security assessments on Azure, AWS, and GCP environments.
•Support container and Kubernetes security assessments.
Leadership & Management Responsibilities
•Manage and lead a team of VAPT consultants and security analysts.
•Review penetration testing reports and ensure quality deliverables.
•Allocate resources and manage multiple assessment engagements.
•Mentor junior team members on offensive security methodologies and best practices.
•Drive remediation discussions with application owners and development teams.
•Participate in customer and executive-level security review meetings.
•Track assessment metrics, remediation status, and risk reduction initiatives.
Core Penetration Testing Skills Required
Application Security
•Strong understanding of:
•OWASP Top 10
•OWASP API Security Top 10
•MITRE ATT&CK Framework
•CWE/SANS Top 25
Hands-on Exploitation Experience
•Web Application Penetration Testing
•API Penetration Testing
•Mobile Application Security Testing
•Authentication and Access Control Testing
•Session Management Testing
•Business Logic Testing
•Manual Exploitation Techniques
•Source Code Assisted Testing
Infrastructure Security Knowledge
•Network Penetration Testing
•Active Directory Security Assessments
•Internal and External Network Assessments
•Cloud Security Assessments
•Container Security Testing
Key Skills Required:
•4-7 years of experience in Application Security and Penetration Testing.
•Minimum 2 years of experience leading or mentoring security teams.
•Proven experience managing enterprise-scale VAPT programs.
•Excellent report-writing and stakeholder management skills.
•Strong verbal and written communication skills.
•Bachelor’s or Master’s degree in Computer Science, Information Security, or related field.
