vapt and red team lead

توضیحات آگهی

Job Overview The VAPT and Red Team Lead leads an engineering driven Offensive Security team covering vulnerability assessment penetration testing adversary simulation DevSecOps and AI security The team identifies exploitable weaknesses validates business impact and supports secure product delivery This role combines hands on technical leadership with team development and ownership of the offensive security roadmap Working with SOC Development DevOps Cloud Infrastructure and Product teams the lead ensures high quality assessments effective remediation and measurable reduction of exploitable risks Responsibilities Define and execute the offensive security strategy operating model and capability roadmap prioritize work based on business risk and team capacity Lead and develop offensive security engineers assign engagements review technical decisions and deliverables and coach team members Lead vulnerability assessments and black box grey box and white box penetration tests across applications APIs internal services networks Active Directory and cloud environments Plan and lead red team engagements with clear objectives scope rules of engagement and safeguards emulate adversary TTPs to validate attack paths and demonstrate business impact Oversee attack surface monitoring and vulnerability triage validate exploitability attack chains and business impact and track remediation through retesting Embed threat modeling secure code review and SAST DAST SCA secret and container scanning into the SDLC and CI CD pipelines with engineering teams Lead AI LLM security assessments covering prompt injection sensitive data exposure unsafe tool use and excessive agent permissions Improve assessment methods security tooling and automation using scripts APIs and AI assisted workflows with appropriate human review Set reporting and evidence standards deliver reproducible findings and practical remediation guidance and coordinate resolution of critical risks before release Track assessment coverage delivery quality remediation time and recurring weaknesses communicate risks capability gaps and improvement priorities to management Requirements 7 years of cybersecurity experience including at least 5 years in penetration testing application security or offensive security Proven experience leading security engineers and technical initiatives developing team capabilities and managing assessment priorities and stakeholders Deep hands on knowledge of web and API security including authentication authorization business logic vulnerability chaining and exploit validation Practical experience assessing IT products such as Web Applications Mobile Applications Desktop Applications Network Services and conducting source code security reviews Strong knowledge of Windows Linux Active Directory network protocols and cloud attack paths familiarity with Docker and Kubernetes security Experience with adversary simulation MITRE ATT CK and red team tools and techniques ability to design realistic attack scenarios and validate paths to critical assets Practical experience with threat modeling to identify trust boundaries map attack paths and prioritize security testing knowledge of OWASP Top 10 API Security Top 10 WSTG and ASVS Experience with DevSecOps GitLab or equivalent CI CD platforms and integrating and tuning application dependency secret and container security tools Proficiency with Burp Suite and vulnerability assessment tools scripting and security automation skills in Python PowerShell Bash Go or similar languages Working knowledge of AI LLM application risks and security testing including prompt injection data leakage and agent tool access controls Strong leadership systems thinking technical decision making and reporting skills ability to explain risks and agree remediation priorities across teams Certifications such as OSCP OSWE OSEP BSCP or CRTO or equivalent practical qualifications are preferred but not mandatory تهران تهران ونک تمام وقت دیجی کالا مدیر میانی جنسیت تفاوتی ندارد فناوری اطلاعات نرم افزار و سخت افزار