Security Engineer Pentesting

Role summary 
We are seeking a highly skilled Security Engineer specializing in Penetration Testing to strengthen our pensive security capabilities. This role is responsible for identifying vulnerabilities across applications, infrastructure, cloud environments, and emerging AI/ML systems, including Large Language Models (LLMs) and GenAI platforms. The ideal candidate combines deep technical pretesting expertise with hands-on experience in AI security, enabling proactive defense against sophisticated and evolving threats. 
 Key Responsibilities: 
Application & API Security Testing

• Perform black-box, gray-box, and white-box penetration testing of: 

• Web applications, APIs (REST/GraphQL), and mobile platforms

•  Identify vulnerabilities including: 

• Authentication/authorization flaws

• Injection attacks

• Business logic vulnerabilities

• Session Management

• Information Gathering

• Data Validation, Governance and Transfer

• Configuration Management

•  Conduct secure code reviews and validate SAST/DAST findings

Infrastructure & Network Penetration Testing

•  Execute penetration testing across: 

• Enterprise networks (internal/external)

• Cloud platforms (AWS, Azure, Google Cloud Platform)

• Hybrid environments

•  Perform: 

• Privilege escalation and lateral movement

• Active Directory assessments (Kerberos, NTLM, etc.)

•  Identify misconfigurations and control weaknesses

AI/ML & GenAI Security Testing

•  Conduct security assessments on: 

• LLM-based applications and AI copilots

• Machine learning models and pipelines

•  Perform: 

• Prompt injection and jailbreak testing

• Data leakage and model abuse scenarios

• Adversarial ML attacks (evasion, poisoning)

•  Assess: 

• RAG (Retrieval-Augmented Generation) pipelines

• Model APIs, plugins, and agent frameworks

• E ectiveness of AI guardrails and controls

Red Teaming & Adversary Simulation

•  Simulate real-world attack scenarios across: 

• Applications, infrastructure, and AI systems

• Develop multi-stage attack chains combining:

• Traditional and AI-specific techniques

•  Support purple team exercises with SOC and detection teams

Automation & AI-Driven Security Testing

• Leverage AI tools to:

• Automate vulnerability discovery

• Generate test cases and attack payloads

• Develop custom tools/scripts using: 

• Python, Bash, PowerShell, or Go

•  Enhance scalability and repeatability of pentesting processes

Reporting & Stakeholder Engagement

•  Deliver: 

• Executive-level summaries (CIO/CISO ready)

• Detailed technical reports with reproduction steps

•  Provide: 

• Risk-based prioritization aligned to business impact

• Actionable remediation guide

•  Collaborate with: 

• Engineering, Cloud, SOC, and DevOps teams

  
Required Qualifications 
Experience

•  5+ years in penetration testing, red teaming, or o ensive security

• Proven experience testing:

• Web applications, APIs, and infrastructure

•  Hands-on exposure to cloud security and enterprise environments

Technical Skills

•  Strong knowledge of: 

• OWASP Top 10 / API Top 10

• OWASP Top 10 LLM

• Network and infrastructure pentesting

• Identity and Active Directory exploitation

•  Experience with tools such as: 

• Burp Suite, Metasploit, Nmap

• BloodHound, Mimikatz, Nessus

  
AI Security 

•  Understanding of: 

• LLM architectures and GenAI use cases

• RAG pipelines, embeddings, and vector databases

• Experience with:

• Prompt injection testing

• AI red teaming or model security assessments

•  Exposure to: 

• LangChain, Semantic Kernel, or similar frameworks

  
Programming

• Proficiency in:

• Python (required)

• Scripting (Bash/PowerShell)

•  Ability to develop: 

• Custom testing tools and exploit scripts

  
Preferred Qualifications

•  Certifications: 

• OSCP, OSEP, or OSCE

• GPEN, GWAPT, or CRTO

• Cloud security certifications (AWS/Azure)

•  Experience with: 

• AI security research or tooling

• Bug bounty programs or red team operations

  
Key Competencies

• Strong attacker mindset and creative problem solving

• Ability to translate technical findings into business risk

• Excellent collaboration across engineering and security teams

• Focus on scalable, repeatable security processes