We are looking for a motivated and enthusiastic Security Analyst (Penetration Testing/VAPT) with 0–2 years of experience to join our Information Security team. The ideal candidate will perform web application, API, network, and mobile application security assessments for payment applications and infrastructure. The role involves identifying and validating security vulnerabilities, providing remediation recommendations, supporting PCI DSS compliance activities, and contributing to the continuous improvement of the organization’s security posture.

Domain: Payment Gateway / Payment Institution / Payment Service Provider (PSP)

Preferred Certifications (Good to Have):

• eJPT
• CEH (Certified Ethical Hacker)
• CompTIA Security+
• Any other relevant cerificates

Preferred Experience

• Internship or academic project in penetration testing or vulnerability assessment.
• Participation in Capture the Flag (CTF) competitions, Hack The Box, TryHackMe or PortSwigger Web Security Academy is an added advantage.

Novalnet e-Solutions Pvt. Ltd. is a Fintech company with a wide array of digital payment solutions. We build payment modules, subscription modules and other e-commerce payment solutions for small to large enterprises. We collaborate with leading banks and acquirers across the international payment industry, focusing on Europe and India, to offer businesses the most wide-ranging secure payment solutions. In addition, we offer software and web development services for various firms.

Novalnet e-Solutions Pvt. Ltd. is headquartered in Chennai and is a brainchild of its parent company, Novalnet AG, based in Munich, Germany. Sister companies of Novalnet e-Solutions Pvt. Ltd. are located worldwide, such as New York, USA and London, UK.

• Perform security assessments of payment applications, APIs, and supporting infrastructure.
• Perform Web Application Penetration Testing (WAPT) and API Security Testing.
• Conduct Network Vulnerability Assessments and basic Penetration Testing (VAPT).
• Identify, validate, and document security vulnerabilities with clear proof of concept and remediation recommendations.
• Validate security controls implemented for payment processing systems.
• Develop, maintain, and execute Python scripts for security testing, vulnerability validation, API testing, automation, and other penetration testing activities.
• Test payment workflows, transaction processing, and payment-related APIs for security weaknesses.
• Perform security testing of payment integrations, including third-party APIs, payment interfaces, and transaction flows.
• Assess and validate security controls protecting cardholder data in alignment with PCI DSS requirements.
• Support PCI DSS compliance activities and security validation exercises, where applicable.
• Perform manual security testing based on the OWASP Top 10 and other industry best practices.
• Prepare detailed technical and executive security assessment reports, documenting identified vulnerabilities, risk ratings, proof of concept, and remediation recommendations.
• Verify remediation fixes and perform retesting.
• Research emerging threats, vulnerabilities, and attack techniques to continuously improve security
  testing methodologies.

• Understanding of common security risks affecting payment applications and APIs.
• Good understanding of payment security concepts, including PCI DSS requirements and secure payment processing.
• Good understanding of Web Application Security concepts.
• Strong ability to write and use Python scripts for security testing, vulnerability validation, automation, API testing, and security assessment activities.
• Strong knowledge of the OWASP Top 10.
• Understanding of the OWASP API Security Top 10.
• Basic understanding of API security concepts and common API vulnerabilities.
• Knowledge of authentication and authorization mechanisms used in payment systems, including OAuth, JWT, and MFA.
• Familiarity with networking concepts, including TCP/IP, DNS, HTTP, HTTPS, and SSL/TLS.
• Good understanding of common web application vulnerabilities, including SQL Injection, XSS, CSRF, SSRF, IDOR, authentication and authorization flaws, file upload vulnerabilities, security misconfigurations, and business logic vulnerabilities.
• Good understanding of Linux and Windows operating systems.
• Strong report-writing and communication skills.
• Exposure to Mobile Application Security Testing.
• Knowledge of secure HTTP headers, cookies, sessions, and JWT security.
• Basic understanding of cryptographic concepts, including encryption, hashing, digital certificates, and TLS/SSL.
• Familiarity with RESTful APIs and JSON.
• Basic knowledge of Active Directory security.
• Basic understanding of cloud security concepts, including (AWS, Azure, and GCP).

Hands-On Experience

• Burp Suite
• Tenable Nessus
• OWASP ZAP
• Nmap
• Nikto
• Postman
• Nuclei
• Wireshark
• Metasploit
• SQLMap
• Python
• Bash (preferred)

Soft Skills

• Strong analytical and problem-solving skills.
• Good written and verbal communication.
• Ability to work independently and collaboratively.
• Willingness to learn new technologies and security methodologies.
• Good time management and documentation skills.

• Career advancement opportunities through training/certification.
• Sponsoring for your certification courses and exams.
• Excellent opportunities to experiment with new technologies.
• Professional and friendly working environment.
• Attractive salary package: Fixed compensation with incentives and performance based bonus.
• Premium private health insurance for you and your parents and Keyman Insurance policy.
• On-site opportunities.
• Seasonal team building activities.
• Well-equipped fitness room.
• Enjoy subsidized accommodation with all the benefits and experience a commute-free job.
• Long term benefits.
• Rewards & Recognition.
• Employee referral program.
• Compulsory off on the weekends and public holidays