Junior Consultant - Multiple Teams

Junior Consultant – Vulnerability Assessment, Penetration Testing & Red Teaming

Location: Clearwater Pune, WFO
Experience: 1–3 years
Employment Type: Full-time
Department: Cybersecurity / Information Security
Reporting To: Senior Consultant / Team Lead

About the Role

Clearwater is looking for a Junior Consultant – Vulnerability Assessment, Penetration Testing (VAPT) & Red Teaming to join our consulting services team.

The role will support the delivery of vulnerability assessments, penetration testing, application and infrastructure security assessments, and red team engagements for clients across different technology environments. The ideal candidate should have a strong foundation in cybersecurity, networking, operating systems and common security testing methodologies, along with a willingness to continuously learn and develop offensive security skills.

Key Responsibilities

Vulnerability Assessment & Penetration Testing

• Assist in conducting vulnerability assessments and penetration tests across:
• Web applications and APIs
• Mobile applications
• Network and infrastructure environments
• Cloud environments
• Internal and external networks
• Wireless environments, where applicable
• Perform reconnaissance, enumeration, vulnerability identification and validation.
• Identify and safely validate security weaknesses using manual and automated techniques.
• Assist with exploitation and post-exploitation activities under approved engagement scopes.
• Conduct security testing in accordance with established methodologies such as OWASP, PTES and NIST, as applicable.
• Analyse scan results and distinguish genuine vulnerabilities from false positives.

Red Teaming

• Support red team and adversary simulation engagements under the guidance of senior team members.
• Assist with reconnaissance, attack-path identification, initial access, privilege escalation, lateral movement and other approved activities.
• Develop an understanding of adversary tactics, techniques and procedures (TTPs), aligned with frameworks such as MITRE ATT&CK and regulatory compliance requirements such as HIPAA, HITRUST, PCI DSS, SOC2, CMMC.
• Assist in evaluating security controls, detection capabilities and potential attack paths.

• Document technical findings with clear evidence and reproduction steps.
• Prepare professional vulnerability assessment, penetration testing and red team reports.
• Provide risk ratings, business impact and remediation recommendations for identified vulnerabilities.
• Maintain accurate POC, testing notes, evidence and supporting documentation.

• Participate in client discussions and technical walkthroughs
• Stay current with emerging vulnerabilities, exploits, attack techniques and cybersecurity trends.
• Research new tools, techniques and methodologies relevant to offensive security.
• Build and maintain practical skills through labs, CTFs and security research.
• Contribute to internal knowledge bases, testing methodologies and reusable security-testing resources.

Required Skills & Qualifications

• Bachelor's degree or equivalent qualification in Computer Science, Information Technology, Cybersecurity or a related discipline.
• 1–3 years of experience in cybersecurity, VAPT, security testing or a related technical role. 
• Good understanding of:
• Networking fundamentals and Windows and Linux operating systems
• Web application architecture and common security vulnerabilities
• Authentication, authorization and session management
• Basic scripting/programming concepts
• Cybersecurity principles and attack methodologies
• Familiarity with OWASP Top 10 and common web application vulnerabilities.
• Basic understanding of MITRE ATT&CK and AI Security.
• Hands-on familiarity with tools such as Burp Suite, Nmap, Tenable Nessus/ OpenVAS, Wireshark, Metasploit, Kali Linux, OWASP ZAP or similar tools.
• Strong analytical and problem-solving skills.
• Good written and verbal communication skills.

• One or more of Certifications such as CEH, eJPT, PNPT, Security+, OSCP or equivalent.
• Exposure to cloud security testing across AWS, Azure or GCP.
• Basic knowledge of Active Directory security and Windows domain environments.
• Familiarity with scripting using Python, PowerShell or Bash.
• Exposure to API, mobile application or container security testing.
• Participation in platforms such as Hack The Box, TryHackMe, PortSwigger Web Security Academy or CTF competitions.
• Basic understanding of security controls such as EDR, SIEM, firewalls, IDS/IPS and WAF.

• Strong curiosity and passion for offensive cybersecurity.
• Ability to think like both an attacker and a defender.
• Ability to work independently as well as within a consulting team.
• Professional approach to handling sensitive client information.