VAPT Engineer

About Globals:

Globals has drastically grown from a small home office to a globally recognized enterprise offering world-class quality solutions on Cybersecurity, Cyberwarfare, ERP Systems, AI, and Enterprise Application Development for various industries including Defence, Education, Government, Financial Services and Transport Industries. Globals has enabled its customers to be game-changers in their industry through its disruptive and innovative solutions.

Globals is certified as a "Great Place to Work" organization for its laudable work culture that helps its team members manage work-life, have dedicated hours to upskill and reskill themselves, and most important to ensure that the projects that they are working on are always unique, challenging their status quo every time. Our unique work culture has made us one of the world’s fastest-growing technology companies as recognized and featured by The Economist.

Our excellence in technical stewardship and service-offering expertise has facilitated our clients ranging from individual entrepreneurs to Fortune Global 500 – to explore new business opportunities, reduce their operational costs significantly and boost their revenues. Today, Globals enjoys a strong position in the industry as a high-performing leader through its technology innovation and remarkable domain expertise. Globals is a CMMI Level 5 certified company.

About the Role:

Globals is a defence-technology and cybersecurity company building secure systems across enterprise, space, drone, and AI domains. As a VAPT Engineer, you will lead vulnerability assessment and penetration testing engagements across networks, web and mobile applications, APIs, and cloud infrastructure — probing systems the way an adversary would, and turning findings into clear, prioritised remediation guidance.

You will work hands-on across the full testing lifecycle: scoping, reconnaissance, exploitation, post-exploitation, and reporting. You will also help mature our AI-assisted testing capability — using and tuning tooling that accelerates scanning, triage, and remediation-suggestion generation — while ensuring every finding is validated by human judgement.

Responsibilities:

• Plan and execute penetration tests across network, web, API, mobile, and cloud targets, from scoping through to retesting.
  
• Perform manual and automated vulnerability assessments; validate scanner output and eliminate false positives through hands-on verification.
  
• Research and reproduce vulnerabilities using OWASP, CVSS scoring, and current CVE intelligence to assess real-world impact.
  
• Develop and maintain Python automation and custom scripts to streamline recurring testing and reporting tasks.
  
• Operate industry tooling — Burp Suite, Metasploit, Nmap, and equivalents — and apply AI/ML-assisted scanning to speed up triage.
  
• Write clear, evidence-backed vulnerability reports with reproduction steps, risk ratings, and actionable remediation guidance for technical and non-technical audiences.
  
• Support secure-development and compliance efforts in line with CERT-In Guidelines and MoD Cyber Security Policy where engagements require it.
  
• Partner with engineering and client teams to verify fixes and confirm closure of reported issues.
  

Must-Have Qualifications:

• 3–5 years of hands-on experience in penetration testing / VAPT across network, web, and API targets.
  
• Strong working knowledge of OWASP Top 10, CVSS scoring, and CVE research.
  
• Proficiency with Burp Suite, Metasploit, and Nmap.
  
• Python scripting for automation of testing and reporting workflows.
  
• Demonstrated API security testing experience.
  
• Proven ability to write professional, client-ready vulnerability reports.
  
• Bachelor's degree in Computer Science, Cybersecurity, or a related field — or equivalent practical experience.
  

Nice to Have:

• Experience with AI/ML-assisted scanning tools (commercial or custom-built) and AI-generated remediation suggestions.
  
• Experience working with a CERT-In empanelled auditing organisation, with direct involvement in security assessment and audit delivery.
  
• Awareness of CERT-In Guidelines 2022 and MoD Cyber Security Policy 2020.
  
• Exploit-development awareness (understanding, not live weaponisation).
  
• CTF participation and/or a documented bug-bounty history.
  
• Relevant certifications — OSCP, CEH, GPEN, or eWPT.
  
• Prior exposure to defence, government, or space/drone security programmes.
  
• C/C++ in addition to Python.
  

Priority Competencies:

The strongest candidates will demonstrate depth across the areas below, weighted roughly in this order of importance to the role:

• Penetration testing — network, web, API: Critical
  
• OWASP / CVSS / CVE research: High
  
• AI/ML-assisted scanning: High
  
• Burp Suite / Metasploit / Nmap: High
  
• Python automation & scripting: High
  
• Vulnerability report writing: Medium
  
• API security testing: Medium
  
• CERT-In / MoD policy awareness: Medium
  
• AI remediation-suggestion generation: Medium
  
• Exploit-development awareness: Baseline
  
• CTF / bug-bounty experience: Bonus
  

Why Globals:

You'll work on security problems that matter — protecting systems across defence, space, and enterprise domains — as part of a small, high-ownership engineering team where your findings directly shape how products are built and hardened. We invest in offensive-security tooling, encourage research and continuous learning, and give engineers real autonomy over how they work.