Senior Security Analyst at SQ1 Security… · Chennai

Job Summary

We are looking for a highly skilled Senior Security Analyst with 6–7 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, mobile applications (Android/iOS), internal and external infrastructure, and AI-powered applications.

The candidate must have strong expertise in manual penetration testing, vulnerability validation, exploitation, security reporting, and remediation guidance. Client handling, technical reporting, and the ability to independently manage end-to-end security assessments are mandatory requirements.

The ideal candidate should be capable of leading technical assessments, communicating findings to clients and stakeholders, mentoring junior team members, and conducting security testing of AI/LLM-based applications and integrations.

Key Responsibilities

1. Web Application and API Penetration Testing

• Conduct manual and automated penetration testing of web applications, REST/SOAP APIs, and GraphQL endpoints.
• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, SSRF, XSS, CSRF, IDOR/BOLA, business logic, file uploads, and privilege escalation.
• Assess JWT, OAuth 2.0, session management, API keys, rate limiting, and sensitive data exposure.
• Perform in-depth testing aligned with OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide.
• Identify complex attack chains and business logic vulnerabilities that automated scanners may miss.

2. Mobile Application Penetration Testing

• Perform static and dynamic security testing of Android APK and iOS IPA applications.
• Analyze application binaries, configurations, permissions, local storage, cryptographic implementations, and network communications.
• Identify insecure data storage, hardcoded secrets, certificate validation weaknesses, insecure deep links, WebView issues, and runtime vulnerabilities.
• Use tools such as MobSF, JADX, apktool, ADB, Frida, objection, and Burp Suite.
• Validate mobile application vulnerabilities and assess associated backend API security.

3. Internal and External Infrastructure Penetration Testing

• Conduct infrastructure VAPT across servers, endpoints, network devices, VPNs, and externally exposed services.
• Perform network discovery, service enumeration, vulnerability validation, exploitation, and privilege escalation testing.
• Assess Windows, Linux, Active Directory, domain controllers, and common enterprise services.
• Identify misconfigurations, weak authentication, excessive privileges, insecure protocols, outdated software, and network segmentation weaknesses.
• Perform authorized Active Directory security assessments, including privilege escalation paths, Kerberoasting exposure, and insecure delegation.
• Use tools such as Nmap, Nessus, Qualys, BloodHound, Impacket, and NetExec.

4. AI and LLM Application Penetration Testing

• Conduct security assessments of AI-powered applications, LLM integrations, chatbots, AI agents, and retrieval-augmented generation (RAG) systems.
• Test for direct and indirect prompt injection, system prompt disclosure, insecure tool invocation, excessive agency, and unauthorized actions.
• Assess sensitive information disclosure, insecure output handling, improper access controls, and cross-user data leakage.
• Test RAG pipelines for document-level authorization weaknesses, data leakage, and malicious content injection.
• Assess AI application integrations, plugins, external tools, APIs, and agent permissions for security weaknesses.
• Evaluate risks associated with insecure output handling, denial-of-service, resource consumption, and model abuse.
• Apply relevant guidance from the OWASP Top 10 for LLM Applications and other applicable AI security testing frameworks.
• Document attack scenarios, business impact, reproducible proof of concept, and practical mitigation measures.

5. Client Handling and Stakeholder Management — Mandatory

• Independently handle client communications throughout the assessment lifecycle.
• Conduct technical kickoff meetings, scope discussions, requirement gathering, and rules-of-engagement reviews.
• Explain technical findings, business impact, severity ratings, and remediation priorities to technical and non-technical stakeholders.
• Participate in client review meetings, vulnerability walkthroughs, remediation discussions, and closure meetings.
• Respond to client queries, clarify findings, provide supporting evidence, and defend technical conclusions with appropriate proof of concept.
• Coordinate with development, infrastructure, and security teams to support remediation and retesting.
• Manage client expectations, assessment timelines, dependencies, and deliverables professionally.

6. Technical Reporting and Documentation — Mandatory

• Prepare high-quality VAPT reports covering executive summaries, scope, methodology, findings, evidence, severity ratings, impact, and remediation recommendations.
• Write clear and reproducible technical findings supported by screenshots, request/response evidence, commands, and proof of concept where appropriate.
• Assign severity using CVSS and business context, ensuring risk ratings are justified.
• Provide practical remediation recommendations tailored to the affected technology and vulnerability.
• Prepare consolidated reports for web applications, APIs, mobile applications, infrastructure, and AI security assessments.
• Review reports for technical accuracy, consistency, completeness, duplication, and false positives before client delivery.
• Prepare retest reports and validate remediation effectiveness.

7. Assessment Ownership and Technical Leadership

• Independently plan and execute end-to-end penetration testing engagements.
• Define testing approaches, prioritize high-risk areas, and adapt methodologies to different environments.
• Review vulnerability findings and technical reports prepared by junior analysts.
• Mentor junior team members on manual testing, exploitation techniques, evidence collection, and reporting standards.
• Support effort estimation, project planning, assessment tracking, and delivery quality.
• Keep up to date with emerging vulnerabilities, exploitation techniques, AI security risks, and penetration testing methodologies.

Required Technical Skills

• Strong hands-on experience in manual web application, API, mobile, and infrastructure penetration testing.
• Practical understanding of OWASP Top 10, OWASP API Security Top 10, OWASP MASVS/MASTG, and relevant AI/LLM security risks.
• Experience with Burp Suite Professional, Nmap, Nessus/Qualys, MobSF, JADX, Frida, objection, and infrastructure testing tools.
• Working knowledge of Windows, Linux, Active Directory, TCP/IP, common network services, and privilege escalation techniques.
• Understanding of authentication mechanisms, cryptography, HTTP/HTTPS, REST APIs, JWT, OAuth 2.0, and application architectures.
• Practical understanding of LLMs, prompt injection, RAG architectures, AI agents, tool calling, and AI application security testing.
• Scripting skills in Python, Bash, or PowerShell for testing and automation.
• Strong technical writing, analytical thinking, and troubleshooting skills.

Mandatory Professional Competencies

• Proven ability to handle clients independently and professionally.
• Strong technical reporting and presentation skills.
• Ability to explain complex vulnerabilities and security risks to different audiences.
• Capability to manage multiple assessments and deliver within agreed timelines.
• Strong ownership, ethical conduct, attention to detail, and adherence to approved scope.
• Ability to work independently while guiding and supporting junior analysts.

Qualifications and Certifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline, or equivalent practical experience.
• 6–7 years of relevant hands-on penetration testing experience.
• Certifications such as OSCP, OSWE, BSCP, CRTO, PNPT, eWPT, eMAPT, or equivalent are desirable.
• Relevant AI security training or practical experience in LLM application testing is an added advantage.

Key Performance Indicators (KPIs)

• Technical quality and completeness of assessment reports.
• Accuracy of vulnerability validation and severity ratings.
• Client satisfaction and effectiveness of technical communication.
• Timely delivery of assessments and reports.
• Effectiveness of remediation guidance and retesting.
• Ability to independently manage engagements and resolve technical challenges.
• Quality of technical reviews and mentoring provided to junior team members.

Important: Candidates must demonstrate practical manual penetration testing skills, independent client handling, and strong reporting capabilities. Experience limited to automated scanning without manual validation will not meet the requirements of this role.