Responsibilities

• Perform manual penetration testing on networks, web-based and mobile applications
• Run scheduled Nessus Scan and other network scans
• Produce high-quality technical reports and presentations and suggest remediation for the vulnerabilities
• Work closely with the development teams and support in fixing security vulnerabilities
• Engage with prospective clients to understand in scope applications and plan out the assessment of their applications or infrastructure
• Work as a single point of contact for existing and potential clients and manage internal and external VAPT assignments
• Drive information security awareness and training to promote a secure environment and an effective security culture
• Support and guide the VAPT team for internal and third-party VAPT assignments for web and mobile applications
• Provide guidance to Junior security experts on complex projects that require your experience and expertise.
• Support pre-sales and sales team with security-related RFP questionnaires and provide ad-hoc support to business units on security-related matters

Requirements

• Strong fundamentals in network security, application security, and cloud security concepts and controls 
• Understanding of the Secure Software Development Life Cycle and DevSecOps principles
• Must be updated with the latest security vulnerabilities
• Good experience with mobile and web VAPT assignments and knowledge of OWASP top 10, WASC, SANS 25
• Hands-on experience with BurpSuite, SqlMap, Nmap, Nessus, Kali Linux, and various paid open-source tools
• Certifications such as  CEH, OSCP, or any similar certification would be an added advantage
• Self-directed technical lead, willing to take ownership and drive results, propose technical directions, make decisions and resolve issues
• Excellent interpersonal skills, ability to navigate through challenging situations, and good analytical skills
• Excellent verbal and written communication skills and the ability to interact with senior managers, subject matter experts, regulatory authorities, and client's Information Security Offices