Penetration Tester

Job Description

We are looking for a highly skilled professional to perform deep-dive penetration tests across diverse environments. The role focuses on identifying logical flaws and executing high-impact attacks in Cloud (Azure/AWS/GCP) and On-Premises Active Directory infrastructures. As a team member, you will design complex attack scenarios and provide strategic remediation guidance to senior stakeholders.

Responsibilities

• Cloud Penetration Testing: Execute complex scenarios on Azure, AWS, and GCP. Focus on Identity (Entra ID), Permissions (IAM/ARM), and exploitation of misconfigured services and resources.

• Active Directory & Identity: Perform advanced attacks against On-Premise Active Directory, assessing Hybrid Identity components and the synchronization security between On-Prem and Cloud.

• Research & Tool Development: Strong interpersonal communication skills and ability to work independently.

• Reporting & Advisory: Deliver high-level technical reports and conduct executive presentations with clear remediation steps for developers, IT teams, and management.

Job Requirements

Experience & Skills:

• 3+ years’ experience in Cyber Security projects or Penetration Testing within a team environment.

• Strong research and analytical skills, with a passion for solving complex security challenges.

• Excellent technical writing and verbal communication skills in English and Hebrew.

• Strong interpersonal communication skills, with the ability to lead projects and work independently.

• Proficiency in scripting and automation (Python, PowerShell, C#, or Go).

Technical Knowledge:

• Cloud (Azure, AWS, GCP): Deep understanding of Entra ID (Azure AD), ARM, and RBAC models. Proven ability to identify attack paths involving Managed Identities, Service Principals, and Graph API abuse. Knowledge of AWS/GCP IAM privilege escalation and cross-account access attacks.

• Active Directory: Expert-level knowledge of Kerberos, NTLM, LDAP, and ACLs. Proficiency in ADCS Exploitation, Delegation attacks, and intricate ACL manipulation.

• Networking: Deep understanding of networking protocols (TCP/IP, SMB, RPC, HTTP/S) and architecture.

• Coding & Tool Development: Programming capabilities with the ability to develop custom tools, automation scripts, and offensive aids to support the team and project needs.

Advantages (Nice to Have):

• Certifications: CRTP, CARTP, CRTE, or OSCP/OSEP.

• Container Security: Knowledge of Kubernetes (K8s) security and Microservices architecture.

• Knowledge of Windows internals & evasion techniques.

Some projects are performed remotely, while others require on-site presence. Occasional international travel is expected.