Role & Responsibilities:

Key highlights of the role are listed below (purely indicative and not limiting):

This position would include the mentioned set of responsibilities but not limited to:

Red Teaming & Adversary Simulation

- Conduct Red Team and adversary simulation exercises.
- Perform Infrastructure, Application, API, and Cloud VAPT.
- Execute Active Directory attacks, lateral movement, and privilege escalation.
- Leverage MITRE ATT&CK; for threat emulation and attack mapping.
- Perform phishing, vishing, and social engineering assessments.
- Develop custom scripts, payloads, and exploits for security testing.

Security Posture & Blue Team Collaboration

- Collaborate with SOC and Blue Teams to improve detection and response.
- Identify gaps in monitoring, logging, and alerting controls.
- Conduct post-assessment reviews and remediation workshops.
- Validate security controls through attack simulations.

Tooling, Governance & Risk Management

- Manage VAPT tools and adversary emulation platforms.
- Review security policies, standards, and procedures.
- Support risk assessments aligned with NIST, ISO 27001, and CIS Controls.
- Conduct continuous attack surface and vulnerability reviews.
- Recommend security improvements across infrastructure and applications.

Leadership & Reporting

- Mentor junior security analysts and penetration testers.
- Provide security guidance to development and IT teams.
- Prepare Red Team reports and threat assessments.
- Present findings and recommendations to stakeholders.
- Promote knowledge sharing and security best practices.

Applicants should possess the following attributes:

Offensive Security & Red Teaming

- Experience in Red Teaming, Penetration Testing, or Offensive Security.
- Strong knowledge of network security,



vulnerabilities, and exploit development.
- Hands-on experience with tools like Cobalt Strike, Metasploit, BloodHound, Mimikatz,Empire, and Burp Suite.
- Expertise in Windows, Linux, and Cloud Security (AWS, Azure, GCP).
- Proficiency in Python, PowerShell, Bash, or C/C++ scripting.
Advanced Attack Techniques
- Experience in Active Directory attacks, Kerberoasting, Pass-the-Hash, and Golden/Silver Ticket attacks.
- Ability to bypass EDR, SIEM, IDS/IPS, firewalls, and endpoint controls.
- Robust understanding of privilege escalation, persistence, and lateral movement.
- Exposure to zero-day research and exploit development.

Social Engineering & Physical Security

- Experience in phishing simulations, OSINT, and credential harvesting.
- Knowledge of physical security assessments, badge cloning, and RFID testing.

Security Frameworks & Compliance

- Working knowledge of MITRE ATT&CK;, NIST, ISO 27001, CIS Controls, and OWASP.
- Ability to assess security controls and recommend improvements.

Leadership & Communication

- Strong analytical, problem-solving, and investigation skills.
- Ability to present technical findings to technical and business stakeholders.
- Experience mentoring junior team members and conducting knowledge-sharing sessions.

Preferred Certifications:

- OSCP, OSEP, OSCE, CRTO, GPEN, GXPN, CISSP, RTO, or equivalent certifications

BOBCARD is a Non-Deposit Accepting Non–Banking Finance Company (NBFC). BOBCARD was established in the year 1994 to cater to the need of rapidly growing credit card industry in a focused manner. BOBCARD is one among the pioneers in Indian card market and was the first non-banking company in India to issue credit cards.

The company’s core business is credit card issuance.

📌 Manager/Deputy Manager - Information Security (Mumbai)
🏢 BOBCARD
📍 Mumbai