Vulnerability Assessment & Penetration Testing Analyst

About the role

Cybervol is seeking an experienced VAPT Analyst to join its Offensive Security team. The role involves conducting comprehensive vulnerability assessments and penetration tests across client infrastructures, applications and networks, and communicating findings to technical and executive audiences.

Key responsibilities

• Design and execute penetration tests on systems, networks, applications, APIs and web platforms.
• Conduct red‑team exercises to evaluate detection and response capabilities.
• Combine automated scanning tools (Nessus, Qualys, OpenVAS) with manual testing techniques.
• Identify, exploit and document vulnerabilities with proof‑of‑concepts, including privilege escalation, lateral movement and post‑exploitation simulations.
• Emulate APT tactics using the MITRE ATT&CK framework and test web applications (OWASP Top 10) with Burp Suite Pro and custom scripts.
• Perform network penetration tests on firewalls, routers, switches and internal services.
• Run regular vulnerability scans across infrastructure, endpoints, cloud environments and applications, validate findings and assign CVSS v3.1 scores.
• Prioritise remediation, track progress and conduct re‑assessments to verify closure.
• Prepare detailed technical reports and executive summaries, and present findings to stakeholders.
• Collaborate with blue‑team and security operations to address detection gaps.

Required profile

• Bachelor’s degree in Computer Science, IT, Cybersecurity or equivalent experience.
• 3+ years of hands‑on penetration testing, red‑team or vulnerability assessment experience.
• Relevant certification such as CEH or eWPT; OSCP, GCIH or CRTOS are a plus.
• Experience planning and executing end‑to‑end VAPT engagements across infrastructure, applications and networks.

Required skills

• Burp Suite Pro, Nessus, Metasploit, Nmap, OWASP ZAP, Wireshark.
• Network protocols (TCP/IP), firewalls (Checkpoint, ASA), routers, switches, VPNs.
• Windows, Linux, Active Directory, privilege escalation techniques.
• Cloud platforms (AWS, Azure, GCP) and container security.
• Web security (OWASP Top 10, API testing, business logic testing).
• SIEM and EDR platforms, incident response awareness.