About this role
Job Summary:
We are seeking a highly skilled and experienced Senior Penetration Tester / Red Team Security Consultant with 1.5 – 2.5 years of hands-on experience in conducting advanced penetration testing and security assessments across Web Applications, Mobile Applications (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.
The ideal candidate should possess strong technical expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting . The candidate must be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations .
Key Responsibilities:
- Conduct advanced VAPT assessments of Web, Mobile (Android, iOS & Huawei), APIs, Networks, and Active Directory environments.
- Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
- Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
- Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities.
- Perform SAST, DAST, and source code security reviews to identify security weaknesses.
- Prepare professional VAPT reports with PoCs , risk ratings, business impact, and remediation recommendations.
- Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers.
- Stay updated with emerging threats, exploitation techniques, and offensive security tools
Requirements
- 1.5–2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.
- Strong expertise in Web Application Penetration Testing, including OWASP Top 10, authentication/authorization testing, business logic vulnerabilities, and advanced exploitation techniques.
- Strong proficiency in API Penetration Testing, including REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.
- Practical experience in Active Directory Penetration Testing and Red Team Operations, including Kerberoasting , AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement.
- Proven experience testing Android and iOS applications for security flaws.
- Experience writing professional VAPT reports .
- Excellent communication skills , both written and verbal.
Preferred Tools & Technologies:
- Burp Suite, ZAP, MobSF , Frida, JADX, Checkmarx , Fortify, SonarQube
- BloodHound , PowerView , Impacket , NetExec , Responder, Mimikatz , Rubeus, Certipy , Metasploit, Evil- WinRM .
- Kali Linux, ParrotOS , or equivalent pentesting environments
Education & Certifications (Preferred but not mandatory):
- Bachelor's degree in Computer Science , Cybersecurity, or related field
- Certifications like eJPT , CEH Practical & Certified Application Security Engineer are preferred.
- Certifications such as OSCP, CEH, or GWAPT are a plus but not mandatory.