Information security engineer at Zscaler in Bengaluru focused on thick-client testing and VAPT: offensive security work against the company's own products and tooling, posted 28 October 2026.

This is internal product security, not customer support: you attack Zscaler's thick clients and harnesses, find vulnerabilities and help engineering close them. The title names thick client testing, harness work and VAPT - vulnerability assessment and penetration testing - as the core of the role.

About Zscaler

Zscaler (NASDAQ: ZS) runs what it calls the world's largest in-line cloud security platform, the Zero Trust Exchange, distributed across more than 200 public data centers globally. Its platform securely connects users, devices and applications for thousands of enterprise customers, protecting them from cyberattacks and data loss. The company says it is building an AI-native enterprise around a Human + AI model of work. Learn more on Zscaler's website.

The role in plain terms

You run offensive testing against desktop clients and test harnesses: reverse engineering, protocol abuse, fuzzing-style harness work and classic VAPT on the products the company ships. Findings go straight to product engineering, so the loop from discovery to fix is short and your work directly hardens a platform used by thousands of enterprises.

What you will do

Per the employer's listing, you will:

Conduct advanced penetration testing on applications and infrastructure leveraging AI to identify and mitigate risks
Conduct security architecture reviews and provide strategic recommendations for complex systems
Partner with engineering and operations teams to prioritise vulnerabilities for remediation
Design and implement security automation to streamline repetitive tasks and improve efficiency
Diagnose problems you can't reproduce locally, using telemetry and good instrumentation

What the employer asks for

These requirements are quoted from the employer's listing, kept in their exact words so eligibility details are not distorted:

Foundational understanding of AI/ML technologies and experience leveraging, securing, or positioning AI-driven solutions to optimize outcomes within your functional domain
3-5 years of experience in manual security assessments using industry-leading tools for web applications, thick clients, and APIs
Expertise in thick client penetration testing across Windows, Mac, Linux, Android, and iOS platforms
Proven experience conducting security architecture reviews in network security and complex application environments
Strong fundamental knowledge of security concepts, cryptography, Unix architecture, and networking
Ability to read/debug C/C++, Java, or JavaScript and engineer custom testing harnesses to identify weaknesses

Who this role suits

Security engineers with hands-on VAPT experience who specifically enjoy client-side and binary-adjacent testing - thick clients are a different skill from web app testing. Good fit for people moving from a security services firm or an internal red team into product security.

Practical notes

Thick-client testing is the differentiator: be ready to discuss tools and techniques beyond Burp Suite, such as reverse engineering and harness building. Recent posting (28 October), so the req is fresh. Zscaler asks across roles about active AI-tool usage in workflows - have a specific example from your testing or triage process.

How to apply

Apply directly on the employer's site: Information Security Engineer - VAPT at Zscaler. We found this listing on the Greenhouse public job board (job-boards.greenhouse.io), where it was posted on 28 Oct 2026 and was still open when we checked on 31 Oct 2026. Before applying, re-read the employer's own description in full, since eligibility details, deadlines and process steps can change at any time and the employer's page is always the final word. Tailor your resume to the specific requirements above rather than sending a generic one: mirror the skills and tools the listing names where you genuinely have them. A short, specific note on why this team and this problem interest you goes further than a long generic cover letter. Never pay a fee to apply or interview; genuine employers, including this one, do not charge candidates.

Related openings on GetFirstJob

If this role is not the right fit, these current openings are in a similar area:

We write and maintain this page from the employer's public listing and link straight to their application page. We do not act as a recruiter, and applying is always free. If the link above stops working, the role has likely been filled.

This is our short summary of the employer's listing. The full description, eligibility and deadline are on the employer's page.