Penetration Tester

Position Overview

We are seeking an experienced Penetration Tester with a strong background in cloud and enterprise environments to join our security team. The ideal candidate will have deep expertise in testing Microsoft Azure environments, virtual machines, Windows infrastructure, and network security controls. This role will be responsible for identifying vulnerabilities, simulating real-world attacks, and providing actionable remediation guidance to strengthen our security posture.

Key Responsibilities

• Azure Penetration Testing
• Perform comprehensive penetration testing on Azure resources, including virtual machines, storage accounts, networking, and identity services.
• Assess Azure Active Directory configurations, RBAC roles, and conditional access policies for security gaps.
• Test Azure-based web applications, APIs, and serverless functions for vulnerabilities.
• Windows & Virtual Infrastructure Testing
• Conduct internal and external penetration tests on Windows servers, endpoints, and Active Directory environments.
• Identify privilege escalation paths, lateral movement opportunities, and misconfigurations.
• Test patch management, Group Policy Objects (GPOs), and endpoint security configurations.
• Network & Perimeter Security
• Perform firewall, VPN, and network segmentation testing.
• Simulate phishing, credential harvesting, and brute-force attacks to test detection and response.
• Vulnerability Analysis & Reporting
• Use commercial and open-source tools to identify and exploit vulnerabilities.
• Document findings with detailed technical reports and executive summaries.
• Work with DevOps, Cloud, and Infrastructure teams to validate fixes and retest remediated vulnerabilities.
• Compliance & Best Practices
• Ensure testing aligns with industry frameworks (e.g., MITRE ATT&CK, OWASP, NIST, CIS Benchmarks).
• Support compliance efforts for standards such as ISO 27001, SOC 2, HIPAA, and PCI-DSS.

Required Qualifications

• 3+ years of experience in penetration testing or offensive security roles.
• Strong hands-on experience with Microsoft Azure security testing, including Azure AD, Azure Security Center, and cloud networking.
• Expertise in Windows security, including Active Directory attacks and defenses.
• Proficiency with tools such as Burp Suite, Nmap, Metasploit, BloodHound, Mimikatz, and PowerShell.
• Experience with scripting languages (PowerShell, Python, Bash) for automation and exploitation.
• Strong understanding of network protocols, cloud architectures, and security hardening techniques.
• Familiarity with MITRE ATT&CK and OWASP Top 10.
• Relevant certifications such as OSCP, OSWA, AZ-500, CEH, GPEN, or CRTP.

Preferred Qualifications

• Experience testing hybrid cloud/on-premise environments.
• Knowledge of container and Kubernetes security in Azure Kubernetes Service (AKS).
• Familiarity with SIEM and endpoint detection tools for red/blue team collaboration.
• Prior experience in regulated industries (healthcare, finance, government).

Soft Skills

• Strong communication skills for both technical and executive audiences.
• Ability to work independently and as part of a cross-functional team.
• Detail-oriented with strong documentation and reporting skills.
• Creative thinking and problem-solving in security testing scenarios.

Job Type: Full-time