Penetration Tester / Cybersecurity Specialist
Security Engineering · Gurugram, India · On-site · Full-time · 2-5 Years
Invield is looking for a Penetration Tester / Cybersecurity Specialist with 2–5 years of relevant experience and a strong foundation in practical security testing. You will assess web applications, APIs, networks and infrastructure, investigate potential vulnerabilities, validate findings through manual testing and document actionable remediation recommendations. You will work with senior security specialists and customer engineering teams throughout the assessment lifecycle. Candidates with 2–3 years of experience should be able to execute assigned testing activities with appropriate guidance. Candidates with 4–5 years should be capable of independently delivering well-scoped assessments and explaining findings to customers. Exposure to cloud platforms, containers, CI/CD security, mobile application testing or AI/LLM application security will be an advantage. Curiosity, careful testing, clear documentation and a willingness to develop deeper technical expertise are essential. Remote or hybrid working will depend on customer requirements. Full-time and contract engagements may be considered.
What you'll do
- Perform vulnerability assessments and penetration testing of web applications, APIs, networks and infrastructure within approved scope.
- Test authentication, authorization, session management, access controls and application business logic.
- Identify and manually validate injection flaws, SSRF, insecure APIs, exposed services and security misconfigurations.
- Use Burp Suite, Nmap, Metasploit and relevant tools to support testing and investigate findings.
- Assess Windows/Linux hosts, network services and security configurations appropriate to the engagement.
- Distinguish confirmed vulnerabilities from false positives and capture reproducible evidence.
- Prepare clear reports describing affected assets, reproduction steps, impact, risk ratings and remediation recommendations.
- Support developers and infrastructure teams in understanding and addressing reported vulnerabilities.
- Perform retesting and document whether remediation resolves the identified issue.
- Participate in customer calls, assessment planning and technical findings discussions.
- Develop or adapt scripts to automate repetitive testing and evidence-collection tasks.
- Support cloud, container and CI/CD security assessments under senior guidance where applicable.
- Follow agreed rules of engagement, protect customer information and promptly escalate critical findings.
What you'll bring
- 2–5 years of relevant hands-on experience in penetration testing, application security or infrastructure security assessments.
- Practical experience testing web applications and APIs, with exposure to network or infrastructure assessments.
- Sound understanding of OWASP Top 10, OWASP API Security and common vulnerability classes.
- Hands-on proficiency with Burp Suite and Nmap, plus familiarity with Metasploit or equivalent tools.
- Understanding of HTTP/HTTPS, TCP/IP, DNS, TLS and Windows/Linux fundamentals.
- Ability to manually validate vulnerabilities and explain their impact and remediation.
- Working knowledge of Python, Bash, PowerShell or a similar scripting language.
- Ability to produce clear technical reports with reproducible evidence and actionable recommendations.
- Strong written and spoken English and the ability to work professionally with developers and customers.
- Ability to execute assigned tests with guidance at the lower end of the experience range and independently deliver defined assessments at the higher end.
- Exposure to Active Directory, AWS/Azure/GCP, Docker, Kubernetes or CI/CD security is desirable.
- OSCP, CEH, GPEN, relevant CREST certifications or equivalent practical certifications are desirable; demonstrable hands-on capability is more important.