We are looking for a highly skilled Ethical Hacker / Application Security Specialist with strong experience in securing transaction-intensive platforms across web, mobile, and APIs.

The role involves advanced penetration testing, fraud simulation, and security validation for critical systems, including Government/PSU or large-scale financial/e-procurement platforms.

Key Responsibilities :

- Perform end-to-end penetration testing on web applications, mobile apps (Android/iOS), and APIs

- Conduct Vulnerability Assessment & Penetration Testing (VAPT) for transaction-heavy systems

- Simulate real-world attack scenarios including fraud attempts, misuse of workflows, and business logic abuse

Identify and exploit vulnerabilities related to :

1. Authentication & Authorization

2. Session & Token Security

3. API Security & Input Manipulation

4. Replay Attacks & Concurrency Issues

Execute controlled breach attempts to validate :

1. Business rules enforcement

2. Access controls

3. Data validations

4. Secure error handling and fail-safe mechanisms

Simulate fraud scenarios such as :

1. Bid rigging / price tampering

2. Fake approvals / bypassing maker-checker controls

3. Multi-account collusion

4. Transaction replay & audit trail manipulation

Analyze vulnerabilities and clearly articulate business impact including :

1. Financial loss

2. Unfair deal allocation

3. Reputational risks

- Work closely with development and business teams to recommend and validate remediation measures

Key Requirements :

- 5 - 7 years of hands-on experience in Penetration Testing & Application Security

- Proven experience in at least 1 Government/PSU project or large-scale financial/e-procurement system

- Strong understanding of e-procurement and fraud patterns (bid manipulation, price tampering, etc.)

Expertise in :

1. Session/Token Security

2. API Penetration Testing

3. Business Logic Testing

4. Fraud Simulation Techniques

5. Track record of identifying and remediating critical/high-risk vulnerabilities

Technical Skills :

Hands-on experience with :

1. Burp Suite

2. OWASP ZAP

3. Kali Linux

4. Metasploit

- Ability to use custom scripts/tools for attack simulation

- Strong understanding of OWASP Top 10 and secure coding practices

Education & Certifications :

- Bachelors Degree in Engineering / IT or equivalent

Mandatory Certification (Any One) :

1. OSCP

2. OSWE

3. CEH Practical

4. CREST