T&T Cyber D&R Consultant Vulnerability Assessment & Penetration Testing (VAPT) Bengaluru
Deloitte India (South Asia) · Consulting & Professional Services
- Bengaluru, India
- On-site
- Posted today
- Closes today
- Cybersecurity
About the job
T&T | Cyber: D&R | Consultant | Vulnerability Assessment & Penetration Testing (VAPT) | Bengaluru
Job requisition ID : 114197
Location : Bengaluru
Entity : Deloitte Touche Tohmatsu India LLP
The team
Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity
Your work profile
Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
Identify, exploit, and validate security vulnerabilities such as:
Authentication and Authorization flaws
SQL Injection
Cross-Site Scripting (XSS)
Server-Side Request Forgery (SSRF)
Insecure Direct Object References (IDOR)
Cross-Site Request Forgery (CSRF)
Remote Code Execution (RCE)
Business Logic Vulnerabilities
API-specific vulnerabilities
Perform manual security testing in addition to automated scanning.
Review source code findings and validate security weaknesses where applicable.
Assess REST, SOAP, GraphQL, and microservice-based APIs.
Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
Conduct remediation validation and re-testing of identified vulnerabilities.
Collaborate with development, DevOps, and architecture teams to drive security improvements.
Support secure SDLC activities and DevSecOps initiatives.
Participate in threat modeling and security design reviews.
Provide security guidance and awareness to application development teams.
Key Skills Required:
3-5 years of hands-on experience in Application Security and VAPT.
Strong understanding of:
OWASP Top 10, OWASP API Security Top 10, HTTP/HTTPS protocols
Authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect)
Session Management and Access Controls
Hands-on experience with tools such as:
Burp Suite Professional, OWASP ZAP, Postman, Nmap
Nessus, Acunetix, Nikto, SQLMap, Metasploit
Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
Familiarity with CI/CD and DevSecOps practices.
Basic understanding of AWS, Azure, or GCP security concepts.
Ability to analyze application architecture and identify attack vectors.
Preferred Qualifications:CEH (Certified Ethical Hacker)
eWPT (eLearnSecurity Web Application Penetration Tester)
GWAPT (GIAC Web Application Penetration Tester)
OSCP (Offensive Security Certified Professional)
PNPT or equivalent offensive security certifications
Knowledge of secure coding practices and code review methodologies.
Experience with SAST, DAST, SCA, and Container Security tools.
Exposure to Kubernetes, Docker, and Cloud Security assessments.
Experience supporting large enterprise vulnerability management programs.
Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field