Consultant / Senior Consultant - VAPT

About the role

EY Mauritius is recruiting a Consultant or Senior Consultant for its Technology Consulting team, which works with clients on digital, data, technology, cybersecurity and transformation programmes. As part of the Cybersecurity offering, you will support clients in identifying, assessing and addressing security risks through vulnerability assessments, penetration testing, Red Teaming, secure architecture reviews and related advisory services.

Key responsibilities

• Conduct vulnerability assessments and penetration testing across web applications, networks, APIs, cloud environments and infrastructure.
• Apply vulnerability assessment methodologies and support remediation validation.
• Use OWASP Top 10, SANS Top 25 and common attack vectors to identify and assess weaknesses.
• Use tools such as Burp Suite, Nmap, Nessus, OpenVAS, Metasploit and Kali Linux.
• Review penetration testing reports and map findings to security monitoring, detection and response use cases.
• Support Red Team and adversary simulation, including threat emulation and attack lifecycle analysis.
• Apply the MITRE ATT&CK Framework and Cyber Kill Chain to identify attack paths, tactics, techniques and procedures.
• Identify indicators of compromise for phishing, credential attacks, privilege escalation, lateral movement, persistence and command-and-control.
• Review application, infrastructure and cloud architectures for design weaknesses and control gaps, and give practical recommendations aligned with industry standards and security-by-design principles.
• Contribute to continuous improvement and the development of EY cybersecurity capabilities.

Required profile

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or a related field, or equivalent professional experience.
• 3-5 years of experience in VAPT, Red Teaming, Secure Architecture Reviews or related cybersecurity consulting roles.
• Practical exposure to security assessments across web apps, networks, APIs, cloud platforms and infrastructure.
• Experience identifying security design weaknesses, control gaps and remediation recommendations.
• Relevant certifications such as eJPT, CEH or CPENT are an advantage.

Required skills

• Vulnerability assessment and penetration testing approaches, and remediation validation.
• OWASP Top 10, SANS Top 25, exploitation techniques and attack chains.
• Familiarity with web, network, API, cloud and infrastructure security assessments.
• Tools: Burp Suite, Nmap, Nessus, OpenVAS, Metasploit, Kali Linux.
• Red Team, adversary simulation, MITRE ATT&CK and Cyber Kill Chain.
• Phishing, credential attacks, privilege escalation, lateral movement, persistence and C2 awareness.
• Strong analytical, investigative and problem-solving skills, and clear communication of technical risks.

Ideally, candidates also have experience with secure architecture reviews, cloud security concepts and security-by-design, and an interest in emerging AI security risks. EY offers a competitive remuneration package, flexible working arrangements and support for career development.