VAPT Penetration Tester / Red Team Engineer

About the role

KPMG India is seeking an experienced security professional to lead Vulnerability Assessment and Penetration Testing (VAPT) across web, mobile, API, network, cloud and infrastructure assets. The role involves identifying, exploiting and documenting security weaknesses to help our clients and internal teams improve their security posture.

Key responsibilities

• Perform comprehensive VAPT engagements for web applications, mobile apps, APIs, networks, cloud environments and infrastructure components.
• Identify, exploit and document vulnerabilities using both manual techniques and automated tools.
• Conduct source‑code reviews to uncover security flaws and develop proof‑of‑concept exploits.
• Prepare detailed technical reports with findings, severity ratings and remediation recommendations.
• Collaborate with product, development and infrastructure teams to remediate identified issues.
• Stay up‑to‑date with the latest vulnerability disclosures, exploit techniques and security tools.
• Participate in red‑team/blue‑team exercises and support compliance audits and security certifications.
• Automate repetitive testing tasks through scripting and tool development.

Required profile

• Minimum 3 years of hands‑on experience in VAPT or security research.
• Strong knowledge of OWASP Top 10, MITRE ATT&CK and common web and mobile security concepts.
• Ability to perform manual testing beyond automated scanner capabilities.
• Excellent analytical and problem‑solving skills.

Required skills

• Burp Suite, Metasploit, Nmap, Nessus, Wireshark, Kali Linux, Nikto, Fortify, ZAP, MobSF.
• Scripting in Python, Bash or PowerShell.
• Understanding of cloud platforms such as AWS, Azure or GCP.
• Experience with source‑code review and secure coding practices.