Offensive Security Developer (Full Stack) | Rust and Node.js | Product engineering | Current Delhi, onsite Why P.
I.
V.
O.
T Security P.
I.
V.
O.
T Security Private Limited is a New Delhi-based offensive cybersecurity company. We think like attackers so our clients can defend like professionals. Our work spans red teaming, adversary simulation, penetration testing, digital forensics and incident response (DFIR), AI and LLM security assessment, and governance programs such as ISMS implementation. We are a product company as much as a services company. Our engineering team builds and ships our own security platforms, and our services teams use those platforms on live engagements. That loop between building and breaking shapes how we work. Our researchers have disclosed vulnerabilities to the Microsoft Security Response Center (MSRC) and presented research at international and national forums.

About the role
• Hiring an Offensive Security Developer (Full Stack) with at least one year of professional full stack development experience
• A developer role first. You design, build, test and ship software that our security teams and clients depend on
• You join the product engineering team and work hands-on on STEP, our BAS platform, and WARUS, our agentic DAST and SAST platform, plus other offensive tooling as priorities evolve
• You work alongside our red team and DFIR practitioners, so you see how the tools you build perform against real environments

Key responsibilities
• BAS platform development: build and improve attack simulation modules, agents, orchestration logic, result collection and reporting, mapped to frameworks such as MITRE ATT&CK;
• Agentic DAST and SAST: develop and refine AI-driven agents that discover,



test and validate vulnerabilities in web applications, APIs and source code
• Full stack ownership: build and maintain backend services and the operator-facing interfaces our analysts and clients use, end to end
• New capabilities: prototype and harden new offensive security features as the product roadmap requires
• Engineering practice: write clean, modular, tested and documented code, follow version control discipline and take part in code reviews
• Secure development: apply secure coding practices to everything you build. Security tooling must itself be secure
• Testing and validation: build lab environments, write test cases and verify that features work reliably before release
• Engagement exposure: support red team, adversary simulation and DFIR activities when assigned
• Documentation: maintain internal technical documentation for the components you own Requirements
• Minimum 1 year of professional experience as a full stack developer (internships do not count toward this)
• Strong programming ability in Rust, covering systems-level code, memory safety, concurrency and async runtimes such as Tokio
• Strong Node.js experience, building and operating production backend services and REST APIs
• Working knowledge of JavaScript or TypeScript on the frontend
• Solid grasp of engineering practice: modular design, testing, debugging, Git workflows and code review




• Understanding of web application and API security, including the OWASP Top 10 and OWASP API Security Top 10
• Working knowledge of Linux, networking fundamentals (TCP/IP, HTTP, DNS) and Windows basics
• Familiarity with Docker, REST APIs and databases
• B.
Tech, B.
E., BCA, MCA or M.
Tech in Computer Science, IT or a related field
• Demonstrable code you can walk us through: shipped products, personal projects or open source
• Willingness to work fully onsite in New Delhi and commit to a long-term engagement Good to have
• Python or Go for tooling and automation work
• Experience with LLM APIs, agent frameworks or tool-calling workflows
• Exposure to static analysis, dynamic scanning or fuzzing tools
• Knowledge of MITRE ATT&CK.; What you will work on and learn
• You will not sit in a sandbox. You work on the same products and engagements our senior team works on
• Product engineering: how a security product moves from design to release, covering architecture decisions, secure SDLC, code review culture, testing and release discipline
• Attack simulation engineering: how real attacker techniques are researched, modelled safely and turned into repeatable simulations mapped to MITRE ATT&CK;
• AI application security: how LLM agents, tool calling and orchestration work in practice, how to use AI for vulnerability discovery, and how AI systems themselves get attacked
• Client delivery: how technical findings become clear, defensible reports for banks, government departments and critical-sector clients
• Research discipline: how vulnerability research and responsible disclosure work inside legal and contractual boundaries

📌 Product Developer (New Delhi)
🏢 P.I.V.O.T Security
📍 New Delhi