Security Engineer Penetration Testing

Job Title: Security Engineer Penetration Testing

Location: San Jose, CA Onsite

Contract

Role summary

We are seeking a highly skilled Security Engineer specializing in Penetration Testing to strengthen our o ensive security capabilities. This role is responsible for identifying vulnerabilities across applications, infrastructure, cloud environments, and emerging AI/ML systems, including Large Language Models (LLMs) and GenAI platforms. The ideal candidate combines deep technical pentesting expertise with hands-on experience in AI security, enabling proactive defense against sophisticated and evolving threats.

Key Responsibilities:

Application & API Security Testing

• Perform black-box, gray-box, and white-box penetration testing of:
• Web applications, APIs (REST/GraphQL), and mobile platforms

Identify vulnerabilities including:

• Authentication/authorization flaws
• Injection attacks
• Business logic vulnerabilities
• Session Management
• Information Gathering
• Data Validation, Governance and Transfer
• Configuration Management

Conduct secure code reviews and validate SAST/DAST findings

Infrastructure & Network Penetration Testing

Execute penetration testing across:

• Enterprise networks (internal/external)
• Cloud platforms (AWS, Azure, Google Cloud Platform)
• Hybrid environments

Perform:

• Privilege escalation and lateral movement
• Active Directory assessments (Kerberos, NTLM, etc.)

Identify misconfigurations and control weaknesses

AI/ML & GenAI Security Testing

Conduct security assessments on:

• LLM-based applications and AI copilots
• Machine learning models and pipelines

Perform:

• Prompt injection and jailbreak testing
• Data leakage and model abuse scenarios
• Adversarial ML attacks (evasion, poisoning)

Assess:

• RAG (Retrieval-Augmented Generation) pipelines
• Model APIs, plugins, and agent frameworks
• E ectiveness of AI guardrails and controls

Red Teaming & Adversary Simulation

Simulate real-world attack scenarios across:

• Applications, infrastructure, and AI systems

Develop multi-stage attack chains combining:

• Traditional and AI-specific techniques

Support purple team exercises with SOC and detection teams

Automation & AI-Driven Security Testing

Leverage AI tools to:

• Automate vulnerability discovery
• Generate test cases and attack payloads
• Develop custom tools/scripts using:
• Python, Bash, PowerShell, or Go

Enhance scalability and repeatability of pentesting processes

Reporting & Stakeholder Engagement

Deliver:

• Executive-level summaries (CIO/CISO ready)
• Detailed technical reports with reproduction steps

Provide:

• Risk-based prioritization aligned to business impact
• Actionable remediation guide

Collaborate with:

• Engineering, Cloud, SOC, and DevOps teams

Required Qualifications

Experience

5+ years in penetration testing, red teaming, or o ensive security

Proven experience testing:

• Web applications, APIs, and infrastructure

Hands-on exposure to cloud security and enterprise environments

Technical Skills

Strong knowledge of:

• OWASP Top 10 / API Top 10
• OWASP Top 10 LLM
• Network and infrastructure pentesting
• Identity and Active Directory exploitation

Experience with tools such as:

• Burp Suite, Metasploit, Nmap
• BloodHound, Mimikatz, Nessus

AI Security

Understanding of:

• LLM architectures and GenAI use cases
• RAG pipelines, embeddings, and vector databases

Experience with:

• Prompt injection testing
• AI red teaming or model security assessments

Exposure to:

• LangChain, Semantic Kernel, or similar frameworks

Programming

Proficiency in:

• Python (required)
• Scripting (Bash/PowerShell)

Ability to develop:

• Custom testing tools and exploit scripts