We are seeking an experienced Penetration Tester to establish and operate a robust, repeatable security-testing capability for our products and supporting infrastructure. The role will design the penetration-testing framework, toolset, processes, and test environments needed to conduct regular assessments across web applications, APIs, virtual machines, cloud configurations, and related infrastructure. A key objective is to validate defenses against contemporary attack techniques and maintain high security coverage across the business product offering.

Responsibilities

- Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking
- Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments
- Perform manual and automated penetration testing of web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
- Identify vulnerabilities, validate exploitability, assess business impact, and provide practical, prioritized remediation recommendations
- Design attack scenarios reflecting modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
- Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting
- Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows
- Stay current on vulnerabilities,



offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements

- 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role
- Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
- Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
- Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
- Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations
- Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
- Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
- Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
- Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

- Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation
- Experience integrating security controls or testing activities into CI/CD pipelines
- Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing
- Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications

📌 Senior/Lead Security Engineer - AI (Pune)
🏢 EPAM Systems
📍 Pune