Join Deloitte's Cyber Risk team as a Consultant specializing in Vulnerability Assessment and Penetration Testing (VAPT). You will play a crucial role in helping organizations enhance their cybersecurity posture by identifying and mitigating potential threats. This is an opportunity to work with cutting-edge technologies and contribute to securing valuable assets against cyberattacks. We are committed to embedding security into the core of business strategies, enabling clients to manage information and technology risks effectively while unlocking new opportunities. Learn more about our Cybersecurity practice.

This role involves comprehensive VAPT across a variety of applications and systems. You will be instrumental in assessing security risks, performing in-depth testing, and providing actionable remediation advice. Collaborate with development and operations teams to champion security best practices and contribute to a culture of resilience.

- Conduct thorough Vulnerability Assessments and Penetration Tests (VAPT) for web applications, mobile applications, APIs, and microservices. - Perform security testing aligned with industry standards like OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE. - Identify, exploit, and validate a wide range of security vulnerabilities, including authentication/authorization flaws, injection attacks, XSS, SSRF, IDOR, CSRF, RCE, and API-specific issues. - Execute both manual security testing and automated scanning techniques. - Review source code findings and validate identified security weaknesses. - Assess various API types such as REST, SOAP, GraphQL, and microservices. - Create detailed VAPT reports that include risk ratings, proof-of-concepts, and practical remediation recommendations. - Conduct re-testing and validation of remediated vulnerabilities. - Collaborate closely with development, DevOps, and architecture teams to implement security enhancements. - Support secure Software Development Lifecycle (SDLC) activities and DevSecOps initiatives. - Participate actively in threat modeling and security design reviews. - Provide expert security guidance and foster security awareness among application development teams.

- Possess 3-5 years of direct experience in Application Security and VAPT. - Demonstrate a strong grasp of OWASP Top 10, OWASP API Security Top 10, HTTP/HTTPS protocols. - Exhibit expertise in authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect), session management, and access controls. - Showcase hands-on proficiency with security testing tools including Burp Suite Professional, OWASP ZAP, Postman, Nmap, Nessus, Acunetix, Nikto, SQLMap, and Metasploit. - Have experience testing APIs, Single Page Applications (SPA), and cloud-native applications. - Be familiar with CI/CD pipelines and DevSecOps methodologies. - Possess a foundational understanding of security concepts within AWS, Azure, or GCP. - Display the ability to analyze application architecture and pinpoint potential attack vectors. - Academic background: Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related discipline. - Preferred qualifications include offensive security certifications such as CEH, eWPT, GWAPT, OSCP, or PNPT, along with knowledge of secure coding and code review. Experience with SAST, DAST, SCA, Container Security, Kubernetes, Docker, Cloud Security assessments, and enterprise vulnerability management programs is also advantageous.