Security Tester - AI-Native Apps & VAPT

About the role

The team is looking for a Security Tester to work on AI-native applications such as LLM-backed products, RAG pipelines and autonomous agents. The role covers both full VAPT engagements against web apps and cloud stacks and red-teaming of AI models. It is based in Coimbatore, India, on a hybrid basis, full-time, reporting to the Security Engineering Lead.

Key responsibilities

• Own end-to-end VAPT engagements across web apps, REST/GraphQL APIs, cloud infrastructure and internal networks, from scoping and threat modelling to exploitation, reporting and retesting.
• Red-team AI-native applications: prompt injection, jailbreaks, system-prompt leakage, insecure output handling, RAG poisoning, training-data extraction, model DoS and excessive-agency abuse.
• Test agents and their tool chains, including tool/function-calling boundaries, MCP server exposure, sandbox escapes and privilege escalation via chained tool calls.
• Map findings to OWASP Top 10, OWASP LLM Top 10, OWASP Agentic Security, MITRE ATT&CK and MITRE ATLAS.
• Score and prioritize vulnerabilities with CVSS, with reproducible PoCs and business impact.
• Write clear, developer-friendly reports with reproduction steps, evidence and remediation guidance.
• Help embed automated security testing (SAST, SCA, DAST, secret scanning, IaC scanning, LLM red-team checks) into CI/CD pipelines and PR gates, then retest and track fixes to closure.
• Track emerging AI attack techniques and update internal red-team playbooks.

Required profile

• 2.5+ years of hands-on offensive security / penetration testing experience.
• Demonstrated full VAPT lifecycle experience for web, API and cloud targets, with strong grasp of OWASP Top 10 and common web/API vulnerabilities.
• Working knowledge of LLM and AI attack surfaces (prompt injection, jailbreaks, OWASP LLM Top 10), or a clear appetite to learn quickly.
• Clear, prioritized reports and ability to explain risk to engineers and non-technical stakeholders.

Required skills

• Burp Suite, OWASP ZAP, Nmap, Nuclei, Metasploit, sqlmap and similar.
• At least one scripting language (Python strongly preferred).
• Web protocols, OAuth 2.0 / OIDC, JWT and session management.
• Familiarity with AWS, Azure or GCP and Docker / Kubernetes.
• Nice to have: LLM red-teaming frameworks (Garak, PyRIT, DeepTeam, promptfoo), AI guardrails, MCP security, RAG pipeline security, MITRE ATLAS, CI/CD integration (GitHub Actions, GitLab CI), Kubernetes RBAC, bug-bounty or CTF experience, and certifications such as OSCP, OSWE, eWPT, GPEN, GWAPT or CEH.