Offensive Security Engineer (VAPT)

Job Summary:

As an Offensive Security Engineer, will act as an elite adversary simulator, leading full-scope red team and purple team engagements to test and strengthen organizational defenses. This role combines advanced offensive techniques with deep blue team knowledge to emulate real-world threats, identify detection gaps, and drive measurable security improvements. Bridge offense and defense—making this a high-impact, high-reward position with hybrid red/purple skills.

Job Duties and Responsibilities:

·       Plan and execute full-scope red team engagements — from initial reconnaissance/OSINT through persistence, lateral movement, privilege escalation, and objective completion (e.g., data exfil, ransomware simulation)

·       Perform advanced adversary emulation using real-world TTPs mapped to MITRE ATT&CK (including living-off-the-land, evasion of EDR/XDR, AMSI/ETW bypass)

·       Conduct purple team exercises — work side-by-side with blue teams/SOC to test detections in real-time, provide instant feedback, and help tune rules/alerts based on observed attack paths

·       Develop and maintain custom offensive tooling (Python, Go, PowerShell, C/C++ for implants, C2 frameworks, evasion payloads)

·       Perform specialized testing: web/app exploitation, Active Directory domination, cloud attacks (AWS/Azure/GCP), mobile/wireless

Qualifications:

·       Graduate of Computer Science/Information Technology

·       At least 3 years of Vulnerability and Penetration Testing experience

Knowledge and skills in:

·       Networking & Protocols – deep understanding of TCP/IP, OSI model, subnetting, routing, DNS, HTTP/HTTPS, SMP, LDAP, Kerberos, etc.

·       Operating Systems Internals – linux (especially), windows, active directory architecture, file systems, processes, memory management

·       Web Technologies – HTTP architecture, client/server-side languages (JavaScript, PHP, Python, .NET, Java) cookies, sessions, authentication flows

·       Security concepts – MITRE ATT&CK framework, OWASP Top 10, common vulnerabilities (CVEs), defense evasion techniques, living-off-the-land