Join our dynamic Cybersecurity team as an Application & API VAPT Consultant. This role focuses on identifying and mitigating security vulnerabilities within web, mobile, API, and cloud applications. You will play a crucial part in enhancing our clients' security posture by conducting comprehensive assessments and advising on remediation strategies.

Deloitte's Cybersecurity practice empowers organizations to prevent cyberattacks and safeguard critical assets. We champion a proactive approach, integrating cyber risk management into strategic development to enable new opportunities while effectively managing information and technology risks. Explore more about our Cybersecurity offerings.

Conduct in-depth Vulnerability Assessments and Penetration Tests (VAPT) across various application types, adhering to industry standards like OWASP Top 10 and API Security Top 10.

Identify and exploit common vulnerabilities including authentication flaws, SQL injection, XSS, SSRF, and business logic errors. Perform manual testing and source code reviews to uncover weaknesses.

Assess REST, SOAP, GraphQL, and microservice APIs, documenting findings with risk ratings and actionable remediation recommendations. Validate fixes through re-testing.

Collaborate closely with development, DevOps, and architecture teams to integrate security into the SDLC and DevSecOps pipelines. Participate in threat modeling and security design reviews, providing essential security guidance.

A minimum of 3 to 5 years of hands-on experience in Application Security and VAPT is required. A strong grasp of OWASP Top 10, OWASP API Security Top 10, HTTP/HTTPS protocols, and various authentication mechanisms like OAuth 2.0, JWT, SAML, and OpenID Connect is essential.

Proficiency with VAPT tools such as Burp Suite Professional, OWASP ZAP, Postman, Nmap, Nessus, Acunetix, Nikto, SQLMap, and Metasploit is crucial. Experience testing APIs, Single Page Applications (SPAs), and cloud-native applications is expected.

Familiarity with CI/CD and DevSecOps practices is advantageous. A foundational understanding of AWS, Azure, or GCP security concepts is beneficial. The role necessitates a Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related field. Relevant cybersecurity certifications are preferred. This position requires the professional to work from our Bengaluru office.