Cloud Penetration Tester

We are looking for a highly skilled professional to perform deep-dive penetration tests across cloud environments. The role focuses on identifying logical flaws and executing high-impact attacks in Azure, AWS, and GCP infrastructures. As a team member, you will design complex cloud attack scenarios and provide strategic remediation guidance to senior stakeholders.

Responsibilities- Cloud Penetration Testing: Execute complex attack scenarios on Azure, AWS, and GCP, focusing on Identity (Entra ID), Permissions (IAM/ARM/RBAC), and exploitation of misconfigured services and resources.

• Cloud Identity & Access: Identify privilege escalation paths, lateral movement, and cross-account/cross-tenant attack paths involving Managed Identities, Service Principals, IAM Roles, and Service Accounts.
• Cloud-Native Services: Assess the security of serverless, container, CI/CD, and PaaS services (e.g., Function Apps, Lambda, AKS/EKS/GKE, DevOps Pipelines, Storage, Key Vault/Secrets Manager).
• Research & Tool Development: Research new cloud attack techniques and develop custom tools and automation to support the team and project needs.
• Reporting & Advisory: Deliver high-level technical reports and conduct executive presentations with clear remediation steps for developers, cloud/DevOps teams, and management. Job Requirements Experience & Skills:- 3+ years' experience in Cyber Security projects or Penetration Testing within a team environment, with hands-on cloud security experience.
• Strong research and analytical skills, with a passion for solving complex security challenges.
• Excellent technical writing and verbal communication skills in English and Hebrew.
• Strong interpersonal communication skills, with the ability to lead projects and work independently.
• Proficiency in scripting and automation (Python, PowerShell, Go, or similar). Technical Knowledge:- Azure: Deep understanding of Entra ID, ARM, and RBAC models. Proven ability to identify attack paths involving Managed Identities, Service Principals, App Registrations, and Graph API abuse.
• AWS / GCP: Strong knowledge of IAM policy evaluation, privilege escalation techniques (e.g., PassRole, AssumeRole abuse), and cross-account access attacks.
• Cloud Architecture & Networking: Understanding of cloud networking (VPC/VNet, Security Groups/NSGs, Private Endpoints) and common cloud architectures.
• Coding & Tool Development: Ability to develop custom tools, automation scripts, and offensive aids. Advantages (Nice to Have):- Certifications: CARTP, CARTE, AWS/Azure security certifications, or OSCP.
• Container Security: Knowledge of Kubernetes (K8s) security and microservices architecture.
• IaC Security: Familiarity with Terraform, ARM/Bicep, or CloudFormation security reviews.
• Hybrid Identity: Knowledge of hybrid identity components (e.g., Entra Connect) and On-Prem ↔ Cloud synchronization security. Some projects are performed remotely, while others require on-site presence. Occasional international travel is expected.