Cloud, Data & Agentic AI Penetration Tester

XenonStack Moments; Dubai; On-site; AED 200,000 - 420,000; Full time

Job summary

XenonStack Software Limited in DIFC, Dubai, UAE is seeking a Penetration Tester – Cloud, Data & Agentic AI with 5–10 years of hands-on security testing experience. The role covers enterprise applications, APIs, cloud infra, Kubernetes, and agentic AI security, with DESC Cyber Force recognition and a strong emphasis on secure, verifiable findings.

You will perform hands-on testing for enterprise and government customers, document vulnerabilities, validate remediations, and deliver reports for

Qualifications

• Must-have certifications: OSCP preferred; CREST CRT, GPEN, GWAPT or equivalent.
• Strong practical expertise in application and API penetration testing.
• Cloud and Kubernetes security testing experience.
• Hands-on testing of Azure and private cloud environments.
• Proficiency with Burp Suite, Nmap, Metasploit, Nuclei, Wireshark.
• Ability to test OAuth 2.0, OIDC, JWT, RBAC/ABAC, and multi-tenant controls.

Responsibilities

• Penetration testing and security assessment across apps, APIs, networks, and cloud.
• Perform black-box, grey-box, and white-box testing using recognized methods.
• Identify auth bypasses, privilege escalation, injections, and insecure configs.
• Test API security per OWASP API Top 10; evaluate OAuth2, OIDC, JWT, RBAC/ABAC.
• Validate multi-tenant isolation and data access controls.
• Develop proof-of-concept exploits with reproducible outcomes.
• Manual security testing beyond automated scanners.
• Assess Azure and private-cloud environments; review Kubernetes security.

Skills

OSCP

CREST CRT

GPEN

GWAPT

OWASP Top 10

OWASP API Top 10

Azure security

Kubernetes security

Burp Suite

Nmap

Metasploit

Nuclei

Wireshark

Tools

Burp Suite Professional

Nmap

Metasploit

Nuclei

Wireshark

Trivy

Job description

XenonStack Software Limited in DIFC, Dubai, UAE is seeking a Penetration Tester – Cloud, Data & Agentic AI with 5–10 years of hands-on security testing experience. The role covers enterprise applications, APIs, cloud infra, Kubernetes, and agentic AI security, with DESC Cyber Force recognition and a strong emphasis on secure, verifiable findings.

You will perform hands-on testing for enterprise and government customers, document vulnerabilities, validate remediations, and deliver reports for