Security Tester (VAPT Engineer)

About the role

SourceFuse Technologies is seeking a proactive Security Tester / VAPT Engineer with 3‑5 years of hands‑on experience. You will perform security assessments across web, mobile, API, cloud, network, and AI/LLM platforms, identify vulnerabilities, validate exploits, and guide remediation.

Key responsibilities

• Conduct comprehensive VAPT for web applications using manual and automated techniques, covering OWASP Top 10, authentication/authorization flaws, business logic issues, and advanced attacks such as SSRF, SSTI, XXE, CSRF, RCE, IDOR.
• Perform security testing of Android and iOS apps, including static/dynamic analysis, runtime instrumentation, reverse engineering, SSL‑pinning bypass, and local storage/keychain review.
• Test REST, GraphQL, SOAP, and gRPC APIs for broken object level authorization, injection, rate‑limit bypass, and data exposure; validate OAuth, JWT, and API‑key mechanisms.
• Assess cloud environments (AWS, Azure, GCP) for misconfigurations, IAM weaknesses, storage and network security issues.
• Execute network and infrastructure VAPT: port enumeration, firewall review, internal/external testing of servers, VPNs, wireless networks, and exposed services.
• Evaluate AI/LLM‑based applications for prompt injection, jailbreak attacks, data leakage, model manipulation, and insecure plugin integrations.
• Prepare detailed vulnerability reports with risk ratings, PoCs, and remediation guidance; collaborate with development and DevOps teams.

Required profile

• 3‑5 years of experience in security testing and vulnerability assessment.
• Strong knowledge of offensive security techniques, secure development practices, and modern attack vectors.
• Ability to work independently, produce clear documentation, and communicate findings to technical and non‑technical stakeholders.

Required skills

• Web application VAPT (OWASP Top 10, authentication/authorization, SSRF, SSTI, XXE, CSRF, RCE, IDOR).
• Mobile security testing (Android, iOS) – static & dynamic analysis, Frida, Objection, MobSF, JADX, Hopper, Ghidra.
• API security testing – REST, GraphQL, SOAP, gRPC, OAuth, JWT, API keys.
• Cloud security – AWS, Azure, GCP, IAM, storage and network configuration review.
• Network & infrastructure testing – port enumeration, firewall assessment, VPN and wireless security.
• AI/LLM security – prompt injection, jailbreak, data leakage, model manipulation.
• Tools: Burp Suite, Wireshark, Nmap, Metasploit, and scripting languages for automation.