VAPT Security Tester

Job Description for VAPT Security Tester

Preferred Experience: 8-12 years

Work Location: Kolkata

About RS Software

RS Software builds global, national and enterprise payment platforms, and has presence in four continents. The product suite combines with knowledge systems built over 30 years, delivering mission-critical payment solutions that combine innovation and entrepreneurship to create the new gold standard for digital payments. With approximately 40% of the global digital payment volumes in 2021 processed on platforms built by RS Software, the vision is to deliver Payments at the Speed of Thought.

RS Software is focused on the global payments modernization market, providing large-scale, high-performance payment systems, serving central Infrastructures, financial institutions, payment network providers, payment processors and software companies providing products to the payment industry. The company's product suite offers ISO 20022 ready, open payments architecture using a cloud-based microservices framework - optimizing costs, seamless integrations with commoditized products, and accelerates the pace of adoption.

The company’s solutions today are installed in 12 of the top 20 banks in India, and the four major platforms built by RS Software cumulatively process annually 350+ billion transactions world-wide, giving the company a rare track record in the payments domain. RS Software’s product suite is getting recognized in some important markets, which is creating strategic partnerships, the foundation for the company’s long-term growth.

RS Software has bult India’s digital payment infrastructure, the three major payment platforms, which are transforming the lives of a billion+ people.

• Instant digital payment platform (UPI)
• Bill payment platform - Bharat Bill Payment System (BBPS)
• Enterprise Fraud and Risk Management (EFRM)

Why RS Software?

RS provides a unique experience of engaging in some world class product development and prestigious large scale payment platforms that caters to billions of people

We provide opportunity to learn and develop high throughput transaction processing systems

RS Software is one of the few technology and payment solutions providers where talented individuals have the opportunity to work on cutting-edge, complex, and mission-critical IT projects. We offer ample career opportunities to hardworking and skilled employees.

Our Talent Management Program is specifically designed to identify the interests of each employee and match them with suitable career paths within their desired domains, allowing them to make the best possible use of their skillsets in reaching their goals.

We invest in the knowledge and skill development of our employees with RS School of Payments – the industry’s most comprehensive training platform. There are three main areas of focus that the Academy and School address: current technology skills, professional development and payments domain knowledge.

Our customized training program, well-defined career mapping process and comprehensive appraisal system is designed to help every employee achieve their goals.

To address the challenges of relocation, we offer employees coming from other regions reimbursement for expenses associated with their moves as well as complimentary interim facilities, such as guesthouse accommodations, to ease the transition. We also assist employees with finding suitable housing.

Job Overview:

As a Security Testing Engineer, you will be responsible for identifying and mitigating security vulnerabilities across our products, networks, and systems. Your expertise will be crucial in ensuring that our security posture remains robust and resilient against cyber threats.

You will be responsible for designing, planning, implementing, and executing security tests, identifying vulnerabilities, and providing recommendations to enhance the overall security posture of our test platform.

Be a part of our passionate and motivated team who are excited to use the latest in software technologies for modern web and mobile application development. Through our products we deliver innovative payment solutions to our global customer base at an accelerated pace.

Key Responsibilities:

• Vulnerability Assessment: Conduct comprehensive vulnerability assessments to identify security weaknesses in applications, networks, and systems.
• Penetration Testing: Design, plan, script and perform advanced penetration testing to simulate real-world attacks and assess the effectiveness of security controls.
• Security Analysis: Analyse security data and findings from assessments and tests to provide actionable insights and recommendations to remediate. Analyze how the identified flaws could affect a business, or business function, if they’re not fixed.
• Reporting: Create reports and recommendations from analysis findings, including the security issues uncovered, level of risk, and remediation strategies for technical and non-technical stakeholders. Present your findings, risk and conclusions to management and other relevant parties.
• Remediation Support: Collaborate with development and IT teams to assist in the remediation of identified vulnerabilities and verify that fixes are effective.
• Tool Utilization: Utilize industry-standard tools and methodologies for security testing, including but not limited to static and dynamic analysis tools, network scanners, and exploit frameworks.
• Research & Development: Stay up to date with the latest security trends, threats, and vulnerabilities. Develop and enhance security testing methodologies and tools within the organization.
• Compliance: Ensure that security practices adhere to global and local standards, regulatory compliance goals (e.g., ISO 27001, GDPR, PCI-DSS etc.).

Desired experience and skills:

• 5-8 years of relevant experience in vulnerability assessment, penetration testing, and security analysis. Previous experience of working with Payment domain, FinTech, Banking domain is an advantage.
• Proficiency in security testing tools and techniques, such as Nmap, Burp Suite, Metasploit, Nessus, Invicti (formerly Netsparker), and OWASP tools.
• Experience with programming or scripting languages (e.g., Python, Bash, PowerShell, JavaScript etc.) for developing custom testing scripts and automation.
• Proven experience of on premise and cloud penetration testing for Web and Mobile applications. Knowledge of network protocols, operating systems, and security principles.
• Sound knowledge and practical experience in performing Unit testing for security, Static application security testing (SAST), Dynamic Application Security Testing (DAST), Interactive application security testing (IAST), Fuzz testing & brute forcing, and Penetration testing.
• Relevant security certifications such as CISSP, CEH, OSCP, GPEN, ISTQB Security Testing Certificate/ CompTIA PenTest+ (PTO-002) or similar are highly desirable.
• Experience in Secure Deployment and operations, System hardening, Runtime Application security protection, Security monitoring and Encryptions
• Well versed in SAMM model and deployment at enterprise level.
• Understanding of threat modelling for Software products preferably cloud scale API applications.
• Strong analytical and problem-solving skills with the ability to think like an attacker and identify potential threats.
• Excellent written and verbal communication skills, with the ability to convey complex security concepts to both technical and non-technical audiences.
• Ability to work effectively both independently and as part of a team in a fast-paced environment.
• Payment/BFS domain experience is good to have.