Cybersecurity Offensive Security Specialist

About the role

We are looking for a Cybersecurity Offensive Security Specialist to lead advanced security assessments across a wide range of environments, including web, mobile, cloud, IoT and operational technology. The role will simulate real‑world attacks, evaluate our defensive controls and deliver actionable remediation to strengthen the organization’s security posture.

Key responsibilities

• Design and execute red‑team exercises and adversary emulation using the MITRE ATT&CK framework.
• Perform phishing, credential‑theft and social‑engineering campaigns, as well as lateral‑movement simulations.
• Conduct black‑box, gray‑box and white‑box penetration tests on external and internal networks, Active Directory, servers, databases, virtualization and cloud platforms.
• Assess web applications with the OWASP testing methodology and identify vulnerabilities such as SQL injection, XSS, CSRF and business‑logic flaws.
• Test REST, SOAP, GraphQL and micro‑service APIs for broken authentication, BOLA, SSRF, JWT weaknesses and other security issues.
• Execute static and dynamic security assessments of Android and iOS applications, including reverse engineering, SSL‑pinning bypass and jailbreak/root detection.
• Evaluate IoT devices and embedded firmware, performing firmware extraction, analysis and wireless protocol testing.
• Collaborate with SOC, SIEM and EDR teams in purple‑team exercises to validate detection and response capabilities.

Required profile

• Strong background in offensive security, red‑team operations or penetration testing.
• Deep understanding of network protocols, operating systems (Windows, Linux) and cloud environments.
• Experience with web, API and mobile application security testing.
• Proven ability to develop custom exploits, proof‑of‑concept code and detailed remediation reports.
• Excellent analytical skills and the capacity to work independently or within a multidisciplinary team.

Required skills

• MITRE ATT&CK framework
• Red‑team and purple‑team methodologies
• SOC, SIEM and EDR analysis
• Active Directory security
• Windows and Linux exploitation
• OWASP testing methodology
• API security testing (REST, SOAP, GraphQL, micro‑services)
• Android and iOS mobile security assessment
• Reverse engineering and firmware analysis
• IoT device security testing
• SSL pinning bypass techniques