We are seeking a highly skilled Security Engineer specializing in Penetration Testing to

strengthen our offensive security capabilities. This role is responsible for identifying

vulnerabilities across applications, infrastructure, cloud environments, and emerging

AI/ML systems, including Large Language Models (LLMs) and GenAI platforms.

The ideal candidate combines deep technical pentesting expertise with hands-on experience in AI security, enabling proactive defense against sophisticated and evolving

threats.

Key Responsibilities:

Application & API Security Testing

- Perform black-box, gray-box, and white-box penetration testing of:
- Web applications, APIs (REST/GraphQL), and mobile platforms
- Identify vulnerabilities including:
- Authentication/authorization flaws
- Injection attacks
- Business logic vulnerabilities
- Session Management
- Information Gathering
- Data Validation, Governance and Transfer
- Configuration Management
- Conduct secure code reviews and validate SAST/DAST findings

Infrastructure & Network Penetration Testing

- Execute penetration testing across:
- Enterprise networks (internal/external)
- Cloud platforms (AWS, Azure, GCP)
- Hybrid environments
- Perform:
- Privilege escalation and lateral movement
- Active Directory assessments (Kerberos, NTLM, etc.)
- Identify misconfigurations and control weaknesses

AI/ML & GenAI Security Testing

- Conduct security assessments on:
- LLM-based applications and AI copilots
- Machine learning models and pipelines
- Perform:
- Prompt injection and jailbreak testing
- Data leakage and model abuse scenarios
- Adversarial ML attacks (evasion, poisoning)
- Assess:
- RAG (Retrieval-Augmented Generation) pipelines
- Model APIs, plugins, and agent frameworks
- E=ectiveness of AI guardrails and controls

Red Teaming & Adversary Simulation

- Simulate real-world attack scenarios across:
- Applications, infrastructure, and AI systems
- Develop multi-stage attack chains combining:
- Traditional and AI-specific techniques




- Support purple team exercises with SOC and detection teams

Automation & AI-Driven Security Testing

- Leverage AI tools to:
- Automate vulnerability discovery
- Generate test cases and attack payloads
- Develop custom tools/scripts using:
- Python, Bash, PowerShell, or Go
- Enhance scalability and repeatability of pentesting processes

Reporting & Stakeholder Engagement

- Deliver:
- Executive-level summaries (CIO/CISO ready)
- Detailed technical reports with reproduction steps
- Provide:
- Risk-based prioritization aligned to business impact
- Actionable remediation guide
- Collaborate with:
- Engineering, Cloud, SOC, and DevOps teams

Required Qualifications

Experience

- 5+ years in penetration testing, red teaming, or oRensive security
- Proven experience testing:
- Web applications, APIs, and infrastructure
- Hands-on exposure to cloud security and enterprise environments

Technical Skills

- Solid knowledge of:
- OWASP Top 10 / API Top 10
- OWASP Top 10 LLM
- Network and infrastructure pentesting
- Identity and Active Directory exploitation
- Experience with tools such as:
- Burp Suite, Metasploit, Nmap
- BloodHound, Mimikatz, Nessus

AI Security

- Understanding of:
- LLM architectures and GenAI use cases
- RAG pipelines, embeddings, and vector databases
- Experience with:
- Prompt injection testing
- AI red teaming or model security assessments
- Exposure to:
- LangChain, Semantic Kernel, or similar frameworks

Programming

- Proficiency in:
- Python (required)
- Scripting (Bash/PowerShell)
- Ability to develop:
- Custom testing tools and exploit scripts

Preferred Qualifications

- Certifications:
- OSCP, OSEP, or OSCE
- GPEN, GWAPT, or CRTO
- Cloud security certifications (AWS/Azure)
- Experience with:
- AI security research or tooling
- Bug bounty programs or red team operations

Key Competencies

- Strong attacker mindset and creative problem solving
- Ability to translate technical findings into business risk
- Excellent collaboration across engineering and security teams
- Focus on scalable, repeatable security processes

📌 Security Engineer (Noida)
🏢 Sonata Software
📍 Noida