Senior Manager - Attack Surface Reduction

About the Role

As Senior Manager of the Attack Surface Reduction team at Nopal Support Services, you will head a distinguished group of security researchers and penetration testers operating within a Managed Security Service Provider (MSSP) environment. Your leadership will drive the delivery of advanced security evaluations ranging from automated asset discovery to manual Red Team engagements, helping global clients solidify their security stance.

Key Responsibilities

• Lead and mentor a skilled team of security experts while fostering a culture of ethical hacking, continuous research, and technical excellence.
• Manage end-to-end security assessment activities including application security testing (DAST, SAST, SCA), API security evaluations, and vulnerability assessments.
• Supervise offensive operations such as Red Teaming, adversarial simulations, and breach and attack simulations.
• Coordinate ransomware resilience testing to validate client defenses against extortion techniques.
• Oversee ongoing attack surface discovery to map digital assets, uncover shadow IT, and identify exposed vulnerabilities.
• Innovate and refine MSSP service offerings by assessing emerging threats and developing new methodologies.
• Engage with senior stakeholders, translating complicated technical insights into comprehensible executive-level risk reports.

Technical Requirements

• Minimum of 10 years experience in Offensive Security, including 3 to 5 years in managerial or leadership capacity.
• Thorough understanding of attacker tactics, exploitation strategies, CI/CD vulnerabilities, and lateral movement in hybrid or cloud-native environments.
• Hands-on proficiency with security frameworks and tools such as Burp Suite, Metasploit, Cobalt Strike, Attack Surface Management tools, and Breach & Attack Simulation platforms.
• Experience securing cloud platforms including AWS, Azure, and GCP along with container technologies like Docker and Kubernetes.
• Strong familiarity with the MITRE ATT&CK framework.
• Certifications highly regarded: OSCE, OSEP, GXPN, CISSP, CCSP, CISM.

Development and Automation Expertise

• Skillful in Python or Go for developing custom security scanners, exploit tools, and automation scripts.
• Competent in Infrastructure as Code technologies such as Terraform or Ansible to build and dismantle complex test environments.
• Experience integrating security testing tools (SAST, DAST, SCA) seamlessly into CI/CD pipelines (GitLab, GitHub Actions, Jenkins) without disrupting developer workflows.
• Advanced ability to test and automate against RESTful and GraphQL APIs to identify vulnerabilities.
• Knowledge of serverless architectures (AWS Lambda, Azure Functions) and container orchestration (Docker, Kubernetes) for penetration testing in microservices ecosystems.
• Fundamental understanding of low-level programming (C, C++, Rust) to oversee exploit development and binary analysis activities.
• Capability to manage and analyze large datasets using SQL/NoSQL databases and ELK stack tools (Elasticsearch, Logstash, Kibana) generated during attack surface mapping.

Leadership and Soft Skills

• Provide straightforward, constructive feedback while maintaining team morale and motivation.
• Strategically guide clients beyond vulnerability discovery toward establishing enduring resilience frameworks.
• Communicate fluently with technical researchers to foster respect and offer credible guidance.
• Resilient under pressure and adept at managing the demands of a 24/7 MSSP environment.

Education Requirement

B.Tech or B.E. in any engineering specialization.