VAPT Engineer – Enterprise & Scalable Platforms (Onsite, Karachi)

About the role

We are seeking a VAPT Engineer to lead security testing for enterprise‑scale platforms, covering web applications, APIs, mobile apps and infrastructure. The position is onsite in Karachi and offers a competitive PKR‑based salary.

Key responsibilities

• Plan and execute approved VAPT engagements for web applications, APIs, mobile applications, and infrastructure.
• Assess authentication, authorization, session management, input validation and common application vulnerabilities.
• Perform API security testing and review security controls for platform integrations.
• Support mobile application security testing across iOS and Android.
• Assess cloud and infrastructure configurations across AWS environments.
• Document findings with clear severity, business impact, evidence and remediation guidance.
• Collaborate with engineering, DevOps, QA and product teams to support remediation and conduct retesting.
• Support secure SDLC practices, security awareness and vulnerability management reporting.

Required profile

• 2–5 years of experience in VAPT, application security or cybersecurity with hands‑on knowledge of OWASP Top 10 and API security risks.
• Relevant certifications such as OSCP, CEH, eJPT, Security+ or equivalent.
• Strong understanding of Linux, networking, HTTP, authentication and common security controls.
• Experience with cloud security, particularly AWS, and exposure to OTT or high‑traffic streaming platforms.
• Ability to produce clear reports and communicate findings to technical and non‑technical stakeholders.

Required skills

• VAPT, OWASP Top 10, API security testing.
• Tools: Burp Suite, Nmap, Nessus, OWASP ZAP.
• Linux, networking, HTTP, authentication.
• Cloud security – AWS.
• Threat modeling and secure code review.