Deloitte's Cyber practice in Bengaluru is looking for an application security consultant to carry out vulnerability assessment and penetration testing (VAPT) on web and mobile applications, APIs and microservices. You will test against OWASP Top 10, OWASP API Top 10, SANS Top 25 and CWE, finding and validating issues such as broken authentication and authorisation, SQL injection, XSS, SSRF, IDOR, CSRF, remote code execution and business-logic flaws through manual testing alongside automated scans. The job includes assessing REST, SOAP and GraphQL APIs, writing detailed reports with risk ratings and fixes, re-testing remediations, and supporting secure SDLC, DevSecOps and threat modelling with development teams. Requirements: 3 to 5 years of hands-on application security and VAPT experience, knowledge of OAuth 2.0, JWT, SAML and session management, and tools such as Burp Suite Professional, OWASP ZAP, Postman and Nmap.