Pentest Engineer

Job Summary

We are seeking a highly skilled and experienced Senior Penetration Tester / Red Team Security Consultant with 1.5–2.5 years of hands-on experience in conducting advanced penetration testing and security assessments across Web Applications, Mobile Applications (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.

The ideal candidate should possess strong technical expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting. The candidate must be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations.

Key Responsibilities

Conduct advanced VAPT assessments of Web, Mobile (Android, iOS & Huawei), APIs, Networks, and Active Directory environments. Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation. Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.

Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities. Perform SAST, DAST, and source code security reviews to identify security weaknesses. Prepare professional VAPT reports with Po. Cs, risk ratings, business impact, and remediation recommendations.

Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers. Stay updated with emerging threats, exploitation techniques, and offensive security tools Requirements 1.5–2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.

Strong expertise in Web Application Penetration Testing, including OWASP Top 10, authentication/authorization testing, business logic vulnerabilities, and advanced exploitation techniques. Strong proficiency in API Penetration Testing, including REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.

Practical experience in Active Directory Penetration Testing and Red Team Operations, including Kerberoasting, AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement. Proven experience testing Android and iOS applications for security flaws. Experience writing professional VAPT reports.

Excellent communication skills, both written and verbal. Preferred Tools & Technologies: Burp Suite, ZAP, MobSF, Frida, JADX, Checkmarx, Fortify, Sonar. Qube Blood. Hound, Power. View, Impacket, Net. Exec, Responder, Mimikatz, Rubeus, Certipy, Metasploit, Evil-WinRM. Kali Linux, ParrotOS, or equivalent pentesting environments Education & Certifications (Preferred but not mandatory): Bachelor's degree in Computer Science, Cybersecurity, or related field Certifications like eJPT, CEH Practical & Certified Application Security Engineer are preferred.

Certifications such as OSCP, CEH, or GWAPT are a plus but not mandatory.