Penetration Tester

We are looking for an experienced Application / Product Security Engineer to strengthen the security of our products and technology ecosystem. In this role, you will work closely with engineering, DevOps, and security teams to identify vulnerabilities, assess security risks, and embed security into products throughout the development lifecycle.

Requirements:

• 4+ years of experience in Application Security, Product Security, or Penetration Testing roles.
• Hands-on experience with Active Directory attacks including Kerberoasting, Pass-the-Hash, DCSync, LDAP enumeration, and privilege escalation paths; proficiency with tools such as BloodHound, Impacket, Mimikatz, CrackMapExec, and Rubeus.
• Deep familiarity with OWASP API Security Top 10 and OWASP Mobile Security Testing Guide (MSTG) and strong hands-on experience with web application, mobile (iOS/Android), and API penetration testing, including complex attack vectors
• Hands-on experience with cloud security assessments across AWS, Azure, and/or GCP, including IAM policies, KMS, network controls, and misconfiguration detection.
• Ability to review system and application architectures and provide actionable security recommendations; experience performing threat modeling using STRIDE, PASTA, or similar methodologies.
• Understanding of AI/ML security risks and familiarity with the MITRE ATLAS framework and its application to AI system threat modeling.
• Experience with Red Team and Purple Team campaigns and familiarity with the MITRE ATT&CK and the Cyber Kill Chain.
• Proficiency with security tools including Burp Suite Pro, OWASP ZAP, Nmap, Metasploit, Frida, objection, and MobSF.
• Scripting proficiency in Python, Bash, or PowerShell for security automation tasks.
• Understanding of container and Kubernetes security concepts.
• Relevant certifications preferred: OSWE, OSEP, CAPE, OSCP, BSCP, CRTE, CRTO, AWS Security Specialty, or equivalent.

Obligations:

• Lead application security assessments, threat modeling sessions, and architecture reviews for products and services.
• Perform comprehensive penetration testing across web, mobile, API, and infrastructure environments.
• Conduct SAST, DAST, and SCA analysis; fine-tune scanning tools and integrate findings into development workflows.
• Collaborate with development teams to embed security controls within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins).
• Work with DevOps teams to assess and improve cloud security posture across AWS, GCP, and Azure.
• Investigate and respond to product security incidents and vulnerability reports.
• Define and enforce secure coding practices, security guidelines, and standards across engineering teams.
• Mentor mid and junior level security engineers and contribute to the growth of the Product Security team.
• Produce detailed security assessment reports and executive-level summaries.