Security Analyst

Job Description:

We are looking for a skilled Security Analyst with strong hands-on experience in Application Security, Vulnerability Assessment and Penetration Testing (VAPT), and API Security.

The ideal candidate will be responsible for identifying, assessing, validating, and reporting security vulnerabilities across web applications, APIs, and infrastructure. The role requires strong practical knowledge of security testing methodologies and the ability to work closely with development and infrastructure teams to drive effective remediation.

Key Responsibilities

• Perform Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, mobile applications, and infrastructure.
• Conduct manual and automated security testing to identify vulnerabilities and security weaknesses.
• Perform Web Application Security testing covering authentication, authorization, session management, input validation, access control, business logic, and common OWASP vulnerabilities.
• Perform API Security testing, including authentication/authorization, BOLA/IDOR, JWT, rate limiting, HTTP methods, and business logic vulnerabilities.
• Conduct reconnaissance and enumeration to identify application attack surfaces, endpoints, parameters, APIs, and exposed services.
• Use security testing tools such as Burp Suite, Nmap, Postman, Nessus, Qualys, and other relevant security tools.
• Manually validate vulnerabilities identified through automated scanning and assess their actual exploitability and impact.
• Identify and analyze vulnerabilities such as SQL Injection, XSS, IDOR/Broken Access Control, authentication issues, security misconfigurations, and other application security risks.
• Prepare detailed security assessment reports including vulnerability description, evidence, severity, impact, and remediation recommendations.
• Collaborate with development, DevOps, and infrastructure teams to explain security findings and support remediation.
• Perform retesting to validate that identified vulnerabilities have been successfully remediated.
• Participate in Threat Modeling, SAST/DAST/SCA, and DevSecOps security activities as required.
• Stay updated with emerging application and API security threats and vulnerabilities.

Required Skills

• 3-7 years of relevant experience in Cybersecurity / Application Security / VAPT
• Strong knowledge of Web Application Security
• Strong knowledge of API Security
• Hands-on experience with Burp Suite
• Good understanding of OWASP Top 10
• Strong understanding of authentication and authorization mechanisms
• Experience identifying and validating IDOR/BOLA and Broken Access Control
• Knowledge of SQL Injection, XSS, CSRF, session management, and security misconfigurations
• Experience with reconnaissance, enumeration, vulnerability validation, and exploitation
• Ability to analyze security findings and recommend appropriate remediation
• Good security documentation and technical communication skills