VAPT Penetration Testing / Red Team Engineer

About the role

KPMG India is seeking an experienced security professional to lead Vulnerability Assessment and Penetration Testing (VAPT) across web, mobile, API, network, cloud and infrastructure assets. You will work closely with development and operations teams to identify, exploit and remediate security weaknesses.

Key responsibilities

• Perform VAPT for web, mobile, API, network, cloud and infrastructure components.
• Identify, exploit and document vulnerabilities using manual and automated techniques.
• Conduct source‑code reviews and develop proof‑of‑concept exploits.
• Prepare detailed technical reports with findings, severity ratings and remediation guidance.
• Collaborate with product, development and infrastructure teams to close security gaps.
• Research emerging threats, vulnerabilities and security tools.
• Participate in red‑team/blue‑team exercises as required.
• Ensure testing aligns with standards such as OWASP, NIST, ISO 27001, etc.
• Automate repetitive testing tasks and support compliance audits.

Required profile

• 3+ years of hands‑on VAPT or security research experience.
• Strong knowledge of OWASP Top 10, MITRE ATT&CK, web and mobile security concepts.
• Ability to perform manual testing beyond automated scanner results.
• Excellent analytical and problem‑solving skills.

Required skills

• Burp Suite, Metasploit, Nmap, Nessus, Wireshark, Kali Linux, Nikto, Fortify, ZAP, MobSF.
• Python, Bash or PowerShell scripting for exploit development.
• Understanding of cloud platforms (AWS, Azure, GCP) is a plus.
• Familiarity with secure coding practices and network security protocols.