Senior Penetration Tester / Cybersecurity Lead
Security Engineering · Gurugram, India · On-site · Full-time · 10–15 years
Invield is looking for a Senior Penetration Tester / Cybersecurity Lead with 10–15 years of relevant experience and strong practical expertise in application and infrastructure security. You will own customer assessments from scoping and planning through manual testing, exploitation validation, reporting, remediation guidance and retesting. The role requires the ability to understand enterprise architectures, identify realistic attack paths and explain security risks to both technical teams and business stakeholders. You will work directly with engineering, DevOps, product and customer teams, lead complex engagements, review assessment quality and mentor security engineers while remaining actively involved in hands-on testing. Experience in cloud security, Kubernetes/OpenShift, DevSecOps, secure architecture reviews, threat modelling, mobile security or AI/LLM application security will be an advantage. Exposure to telecom, large enterprises and international customer environments is valuable. Remote or hybrid working will depend on customer requirements. Full-time and contract engagements may be considered.
What you'll do
- Lead end-to-end penetration testing across web applications, APIs, networks, enterprise infrastructure and cloud environments.
- Define assessment scope, testing methodology, rules of engagement, deliverables and execution plans with customers.
- Perform advanced manual testing of authentication, authorization, session management, access controls and business logic.
- Identify and safely validate injection flaws, SSRF, insecure APIs, privilege escalation, exposed services and security misconfigurations.
- Assess Windows/Linux systems, Active Directory, network services and enterprise security configurations.
- Evaluate realistic attack paths and vulnerability chains to demonstrate technical and business impact.
- Review cloud, container and Kubernetes/OpenShift security where included in the assessment scope.
- Assess CI/CD pipelines, secrets management, dependency risks and DevSecOps controls where applicable.
- Prepare and review reports containing reproducible evidence, risk ratings and actionable remediation recommendations.
- Present findings to developers, architects, security leaders and customer stakeholders.
- Guide remediation discussions and perform retesting to validate vulnerability closure.
- Mentor security engineers and maintain consistent testing quality across engagements.
- Coordinate customer communication, assessment priorities, delivery timelines and technical escalations.
What you'll bring
- 10–15 years of relevant cybersecurity experience with substantial recent hands-on penetration-testing work.
- Proven ability to independently lead complex enterprise assessments from scoping through closure.
- Deep understanding of OWASP Top 10, OWASP API Security and manual application-security testing.
- Strong practical proficiency with Burp Suite, Nmap, Metasploit and equivalent assessment tools.
- Strong knowledge of TCP/IP, DNS, HTTP/HTTPS, TLS, Windows/Linux and enterprise infrastructure.
- Practical experience assessing Active Directory and identifying privilege-escalation or access-control weaknesses.
- Ability to assess exploitability, connect findings to business risk and recommend practical remediation.
- Working proficiency in Python, Bash, PowerShell or similar languages for testing and automation.
- Experience managing customer discussions, reviewing technical reports and mentoring security engineers.
- Strong written and spoken English, including the ability to communicate with international enterprise customers.
- Experience with AWS, Azure, GCP, Docker, Kubernetes/OpenShift or DevSecOps security is desirable.
- OSCP, OSCE, OSEP, GPEN, relevant CREST certifications, CEH or CISSP are desirable; demonstrable practical capability carries greater weight than certifications.