VAPT Consultant

Job Responsibilities VAPT Engineer

Perform Vulnerability Assessment and Penetration Testing (VAPT) for web applications, APIs, networks, and IT infrastructure.

Conduct authenticated and unauthenticated vulnerability assessments to identify security weaknesses.

Execute manual penetration testing to validate vulnerabilities and assess their exploitability.

Use security testing tools such as Burp Suite, OWASP ZAP, Nessus/Tenable, Nmap, Metasploit, Kali Linux, and Postman.

Identify and validate security vulnerabilities, including OWASP Top 10 risks and common network security weaknesses.

Prepare detailed VAPT reports covering identified vulnerabilities, severity levels, technical evidence, risk impact, and remediation recommendations.

Collaborate with development, infrastructure, and security teams to support vulnerability remediation.

Perform retesting after remediation and verify vulnerability closure.

Support secure code review and application security assessments.

Maintain VAPT documentation, testing procedures, and assessment records.

Support security compliance audits and assessments in accordance with applicable security standards and organizational policies.

Ensure all penetration testing activities are conducted within the approved scope and follow established security testing methodologies.

Required Technical Skills

Hands-on experience in VAPT and manual penetration testing.

Knowledge of web application, API, network, and infrastructure security testing.

Experience with Burp Suite, OWASP ZAP, Nessus/Tenable, Nmap, Metasploit, Kali Linux, and Postman.

Understanding of OWASP Top 10 and OWASP Web Security Testing Guide (WSTG).

Ability to prepare technical VAPT reports and recommend remediation measures.

Experience with vulnerability validation, remediation tracking, and retesting.

Preferred Candidate Profile

Candidates with practical experience executing penetration tests, validating vulnerabilities, preparing technical reports, and conducting remediation retesting are preferred. Candidates with experience limited to GRC, compliance, or reviewing third-party VAPT reports may not be suitable for this hands-on role.