Deloitte's Cyber Detect & Respond team in Bengaluru is hiring an application and API VAPT consultant with 3-5 years of hands-on offensive security experience. You will run vulnerability assessments and penetration tests on web apps, mobile apps, APIs and microservices, following OWASP Top 10, OWASP API Security Top 10, SANS Top 25 and CWE. The role involves finding, exploiting and validating issues such as broken authentication and authorization, SQL injection, XSS, SSRF, IDOR, CSRF, remote code execution and business-logic flaws, doing manual testing alongside automated scanning, and reviewing source-code findings. Clear reporting of risks and fixes is part of the job.