Pentest Engineer
Summary
A penetration testing / red team consultant (1.5–2.5 years experience) conducting VAPT on web apps, mobile apps (Android, iOS, Huawei), APIs, networks, and Active Directory, including red team operations and SAST/DAST reviews, then writing client-facing VAPT reports and guiding junior testers. Tooling spans Burp Suite, MobSF/Frida, and BloodHound/Impacket/Metasploit.
Job Summary:
We are seeking a highly skilled and experienced Senior Penetration Tester / Red Team Security Consultant with 1.5–2.5 years of hands-on experience in conducting advanced penetration testing and security assessments across Web Applications, Mobile Applications (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.
The ideal candidate should possess strong technical expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting. The candidate must be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations.
Key Responsibilities:
- Conduct advanced VAPT assessments of Web, Mobile (Android, iOS & Huawei), APIs, Networks, and Active Directory environments.
- Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
- Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
- Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities.
- Perform SAST, DAST, and source code security reviews to identify security weaknesses.
- Prepare professional VAPT reports with PoCs, risk ratings, business impact, and remediation recommendations.
- Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers.
- Stay updated with emerging threats, exploitation techniques, and offensive security tools
Requirements
- 1.5–2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.
- Strong expertise in Web Application Penetration Testing, including OWASP Top 10, authentication/authorization testing, business logic vulnerabilities, and advanced exploitation techniques.
- Strong proficiency in API Penetration Testing, including REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.
- Practical experience in Active Directory Penetration Testing and Red Team Operations, including Kerberoasting, AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement.
- Proven experience testing Android and iOS applications for security flaws.
- Experience writing professional VAPT reports.
- Excellent communication skills, both written and verbal.
Preferred Tools & Technologies:
- Burp Suite, ZAP, MobSF, Frida, JADX, Checkmarx, Fortify, SonarQube
- BloodHound, PowerView, Impacket, NetExec, Responder, Mimikatz, Rubeus, Certipy, Metasploit, Evil-WinRM.
- Kali Linux, ParrotOS, or equivalent pentesting environments
Education & Certifications (Preferred but not mandatory):
- Bachelor's degree in Computer Science, Cybersecurity, or related field
- Certifications like eJPT, CEH Practical & Certified Application Security Engineer are preferred.
- Certifications such as OSCP, CEH, or GWAPT are a plus but not mandatory.