Penetration Testing & Red Team Engineer

Job Overview

We are seeking a skilled Penetration Testing & Red Team Engineer proficient in Vulnerability Assessment and Penetration Testing (VAPT), securing web and mobile applications, infrastructure testing, API security, Active Directory, and executing red team operations.

Key Responsibilities

• Execute VAPT across diverse environments including web, mobile, APIs, networks, cloud platforms, and infrastructure.
• Conduct security assessments using Black Box, Grey Box, and White Box testing techniques.
• Lead Red Team operations such as domain enumeration, privilege escalation, credential extraction, lateral movement, reverse shell deployment, and circumventing security controls.
• Carry out security evaluations for Android and iOS applications.
• Assess API security for RESTful and SOAP services.
• Perform penetration testing on Active Directory and related infrastructure components.
• Utilize tools like Fortify and SonarQube for static and dynamic application security testing along with source code reviews.
• Review security configurations and verify compliance with CIS Benchmarks.
• Identify and verify vulnerabilities, ensuring the elimination of false positives.
• Develop comprehensive security assessment reports with remediation guidance and client-ready documentation.
• Collaborate with development, operations, and security teams to facilitate vulnerability fixes and promote best security practices.

Required Skills and Experience

• Thorough understanding of penetration testing methodologies including OWASP Top 10 and SANS Top 25.
• Practical experience with tools such as Burp Suite, ZAP, Nessus, Nmap, Metasploit, Acunetix, OpenVAS, SQLMap, and Wireshark.
• Familiarity with mobile security tools including Frida, Objection, MobSF, Drozer, and Jadx.
• Knowledge of cloud security in AWS and Azure environments.
• Strong skills in report writing, documentation, and communication with clients.

Certifications

Possession or pursuit of relevant qualifications like OSCP, CRTP, eWPT, eJPT, CAP, or CEH is advantageous. The OSCP certification is currently in progress.