Role Summary

We are seeking an experienced Penetration Tester to establish and operate a robust, repeatable security-testing capability for our products and supporting infrastructure.

The role will design the penetration-testing framework, toolset, processes, and test environments needed to conduct regular assessments across web applications, APIs, virtual machines, cloud configurations, and related infrastructure. A key objective is to validate defenses against modern, AI-enabled attack techniques and maintain high security coverage across the business product offering.

The successful candidate must understand how attackers may use AI-assisted tools and tactics to identify, automate, scale, or chain attacks against conventional products and infrastructure.

Key Responsibilities

- Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking.
- Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments.
- Perform manual and automated penetration testing of:

- Web applications and customer-facing portals.
- APIs, including authentication, authorization, input validation, rate limiting, and business-logic vulnerabilities.
- Virtual machines, operating systems, networks, services, and administrative interfaces.
- Cloud environments, including identity and access management, storage, networking, logging, secrets, containers, and configuration controls.

- Identify vulnerabilities, validate exploitability, assess business impact, and provide practical, prioritized remediation recommendations.
- Test security controls such as identity and access management, authorization boundaries, session management, encryption, secrets handling, network segmentation, monitoring, alerting, and incident-response capabilities.




- Design attack scenarios that reflect AI-assisted attacker behavior, including accelerated reconnaissance, vulnerability discovery, credential attacks, automated exploitation, attack chaining, and high-volume abuse.
- Validate whether security controls remain effective against automated, scalable, and rapidly evolving attack techniques.
- Collaborate with software engineering, Dev Ops, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting.
- Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows.
- Maintain documentation for testing procedures, tool configurations, test results, known risks, remediation status, and security metrics.
- Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and AI-enabled attack trends.

Required Qualifications
- 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role.
- Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services.
- Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices.
- Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform.
- Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations.




- Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security assessment tools.
- Proficiency in scripting or programming using Python, Bash, Power Shell, Java Script, or similar languages.
- Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports.
- Strong communication skills and the ability to work constructively with engineering and business stakeholders.

Preferred Qualifications
- Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation.
- Experience integrating security controls or testing activities into CI/CD pipelines.
- Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing.
- Understanding of how generative AI and agentic tools can enhance reconnaissance, social engineering, vulnerability research, exploit development, and attack automation.
- Ability to translate emerging AI-assisted attack patterns into realistic test cases for conventional web applications, APIs, cloud environments, and infrastructure.
- Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications.

Key Deliverables
- A documented and scalable penetration-testing framework with explicit testing standards and reporting templates.
- A maintained toolchain and test environment for scheduled and on-demand assessments.
- Regular penetration-test reports with validated findings, risk ratings, remediation guidance, and retest results.
- Security test cases that cover conventional threats as well as AI-enabled attacker tactics.
- Measurable improvements in product and infrastructure security posture, remediation timelines, and coverage of critical attack surfaces.

📌 Penetration Tester (India)
🏢 Synstack Technologies
📍 India