Pentest Engineer

Trillium Information Security Systems (TISS)

Karachi , Pakistan

Apply Now

Posted 2 days ago 12 views Report Job

We are looking for a highly skilled Senior Penetration Tester / Red Team Security Consultant with 1.5 to 2.5 years of hands-on experience in advanced penetration testing and security assessments. The role involves working across Web Applications, Mobile Applications (Android, iOS, and Huawei), APIs, Network Infrastructure, and Active Directory environments. The ideal candidate will have strong expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting. They should be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations.

Key Responsibilities:
- Conduct advanced Vulnerability Assessment and Penetration Testing (VAPT) for Web, Mobile (Android, iOS, Huawei), APIs, Networks, and Active Directory environments.
- Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
- Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
- Conduct API Security Testing focusing on authentication, authorization, token security, and business logic vulnerabilities.
- Perform Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and source code security reviews to identify weaknesses.
- Prepare professional VAPT reports that include Proof of Concepts (PoCs), risk ratings, business impact analysis, and remediation recommendations.
- Communicate findings effectively to clients, conduct vulnerability revalidation, and mentor junior penetration testers.
- Stay updated with emerging threats, exploitation techniques, and offensive security tools to maintain cutting-edge expertise.

Required Qualifications:
- 1.5 to 2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.
- Strong expertise in Web Application Penetration Testing, including OWASP Top 10 vulnerabilities, authentication/authorization testing, business logic flaws, and advanced exploitation techniques.
- Proficiency in API Penetration Testing covering REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.
- Practical experience in Active Directory Penetration Testing and Red Team operations, including techniques such as Kerberoasting, AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement.
- Proven experience testing Android and iOS applications for security vulnerabilities.
- Experience in writing detailed, professional VAPT reports.
- Excellent communication skills, both written and verbal, to clearly articulate technical findings and recommendations.

Preferred Qualifications and Tools:
- Familiarity with tools such as Burp Suite, OWASP ZAP, MobSF, Frida, JADX, Checkmarx, Fortify, and SonarQube for application security testing.
- Experience with Active Directory and Red Team tools including BloodHound, PowerView, Impacket, NetExec, Responder, Mimikatz, Rubeus, Certipy, Metasploit, and Evil-WinRM.
- Comfortable working in Kali Linux, ParrotOS, or equivalent penetration testing environments.
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field is preferred but not mandatory.
- Relevant certifications such as eJPT, CEH Practical, and Certified Application Security Engineer are advantageous.
- Additional certifications like OSCP, CEH, or GWAPT are considered a plus.

This role offers the opportunity to work in a dynamic security environment, engaging with diverse technologies and challenging security scenarios, while contributing to the protection of critical digital assets.