Job Summary
Job Title
Security Testing & Vulnerability Assessment Engineer (VAPT) – Cloud & AI Security
Job Summary
We are seeking a highly skilled Security Testing & Vulnerability Assessment Engineer with expertise in Vulnerability Assessment and Penetration Testing (VAPT), OWASP Security Testing, Security Compliance, Vulnerability Management, AI Security Testing, and Cloud Security Assessments. The ideal candidate will be responsible for identifying, assessing, and mitigating security vulnerabilities across enterprise applications, cloud platforms, APIs, infrastructure, and AI/GenAI solutions.
The role requires hands-on experience in conducting comprehensive security assessments, penetration testing, cloud security reviews, and compliance validation activities. The candidate will work closely with development, DevOps, cloud, AI/ML, and security teams to ensure secure software delivery and maintain a strong organizational security posture.
Key Responsibilities
Vulnerability Assessment & Penetration Testing (VAPT)
- Perform vulnerability assessments and penetration testing for web applications, APIs, mobile applications, cloud environments, and enterprise systems.
- Identify security weaknesses and validate exploitability through controlled testing methodologies.
- Conduct black-box, gray-box, and white-box security assessments.
- Execute internal and external network penetration testing exercises.
- Document findings and provide detailed remediation recommendations.
Application Security Testing
- Conduct secure code reviews and application security assessments.
- Perform Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST).
- Validate application security controls and authentication mechanisms.
- Assess session management, authorization, encryption, and input validation controls.
- Ensure adherence to secure coding practices and industry standards.
OWASP Security Validation
- Evaluate applications against OWASP Top 10 security risks.
- Identify vulnerabilities such as:
- Broken Access Control
- Injection Attacks
- Security Misconfigurations
- Cryptographic Failures
- Authentication Weaknesses
- Cross-Site Scripting (XSS)
- Server-Side Request Forgery (SSRF)
- Vulnerable Components
- Conduct security reviews during development and pre-production releases.
- Support secure SDLC initiatives and security-by-design implementations.
Cloud Security Assessment
- Perform security assessments of cloud-native applications and infrastructure.
- Evaluate cloud security configurations across AWS, Azure, and Google Cloud Platform (GCP).
- Review IAM policies, network security controls, storage configurations, and encryption standards.
- Conduct cloud security posture assessments and identify misconfigurations.
- Assess container, Kubernetes, and microservices security implementations.
AI & GenAI Security Testing
- Conduct security testing of AI/ML and Generative AI applications.
- Assess AI systems for risks related to:
- Prompt Injection
- Data Poisoning
- Model Manipulation
- Data Leakage
- Adversarial Attacks
- Unauthorized Access
- Validate security controls for RAG architectures, vector databases, and LLM integrations.
- Evaluate AI governance and responsible AI security requirements.
- Develop AI-specific threat models and test scenarios.
Vulnerability Management
- Manage enterprise vulnerability assessment programs.
- Analyze scan results and prioritize remediation activities based on risk.
- Track vulnerabilities through closure using governance processes.
- Establish vulnerability reporting dashboards and KPIs.
- Coordinate with application and infrastructure teams for remediation planning.
Security Compliance & Governance
- Support compliance assessments and audits.
- Ensure security controls align with organizational security standards.
- Assist with regulatory and compliance reviews.
- Prepare evidence and documentation required for audits.
- Participate in security governance reviews and risk assessments.
Security Reporting & Risk Analysis
- Generate VAPT reports with executive summaries and technical findings.
- Present security risks and remediation strategies to stakeholders.
- Conduct threat assessments and risk analysis activities.
- Develop security metrics and reporting mechanisms.
- Support management with compliance and security posture updates.
Skill Requirements
Technical Skills Required
VAPT & Security Testing
- Vulnerability Assessment & Penetration Testing (VAPT)
- Web Application Security Testing
- Mobile Application Security Testing
- API Security Testing
- Network Penetration Testing
- Infrastructure Security Assessment
Application Security
- Secure Code Review
- SAST & DAST
- Threat Modeling
- Secure SDLC
- Security-by-Design
- DevSecOps Practices
OWASP & Security Standards
- OWASP Top 10
- OWASP API Security Top 10
- CWE/SANS Top 25
- MITRE ATT&CK Framework
- Security Control Validation
Cloud Security
- Google Cloud Platform (GCP)
- AWS Security
- Azure Security
- Kubernetes Security
- Container Security
- Cloud Security Posture Management (CSPM)
- Identity & Access Management (IAM)
AI Security
- AI/ML Security Testing
- Generative AI Security
- LLM Security Assessment
- AI Threat Modeling
- Prompt Security Validation
- AI Governance Controls
- RAG Security Testing
Vulnerability Management Tools
- Nessus
- Qualys
- Rapid7 InsightVM
- OpenVAS
- Burp Suite
- OWASP ZAP
- Nmap
Metasploit
Other Requirements
- Bachelor's or Master's degree in Cybersecurity, Computer Science, Information Security, or related field.
- 5+ years of experience in Vulnerability Assessment and Penetration Testing.
- Strong understanding of application security and secure development practices.
- Experience performing cloud security assessments and reviews.
- Hands-on expertise in OWASP Top 10 testing methodologies.
- Knowledge of AI/GenAI security principles and emerging threats.
- Experience working with stakeholder teams to drive remediation activities.
Preferred Certifications
- CEH (Certified Ethical Hacker)
- OSCP (Offensive Security Certified Professional)
- OSWE (Offensive Security Web Expert)
- CISSP (Certified Information Systems Security Professional)
- CCSP (Certified Cloud Security Professional)
- CompTIA Security+
- Google Professional Cloud Security Engineer
- GIAC Penetration Tester (GPEN)
- Certified Red Team Professional (CRTP)
Key Competencies
- Vulnerability Assessment & Penetration Testing
- Security Risk Analysis
- Ethical Hacking
- Cloud Security Assessment
- Application Security Testing
- AI Security Validation
- Compliance Awareness
- Security Governance
- Incident Investigation
- Problem Solving
- Analytical Thinking
- Stakeholder Communication
Ideal Role Designation
- Security Testing Engineer
- VAPT Engineer
- Penetration Tester
- Application Security Engineer
- Cloud Security Assessment Specialist
- AI Security Testing Engineer
- Senior Cyber Security Consultant