Senior Offensive Security Consultant

Dmatics It Solutions; Dubai; On-site; AED 300,000 - 600,000; Full time

Job summary

Dmatics It Solutions in the United Arab Emirates seeks a senior security consultant specializing in Vulnerability Assessment and Penetration Testing (VAPT) and adversary simulation. You will lead complex tests across web apps, networks, and Microsoft 365 environments, delivering risk-rated findings with actionable remediations.

Responsibilities include designing controlled red-team scenarios, validating controls, and supporting ISO 27001 security assessments.

Qualifications

• 8+ years hands-on web application VAPT experience.
• 5+ years Microsoft 365 / Entra ID security assessment experience.
• 5+ years Active Directory security experience.
• Strong Windows and Linux security, privilege escalation knowledge.
• Experience in network segmentation and firewall/security-policy assessment.
• Strong understanding of OWASP testing methodology and vulnerability validation.
• Familiarity with the MITRE ATT&CK framework and ISO 27001 controls.
• Excellent report writing and customer presentation skills.

Responsibilities

• Perform comprehensive web app VAPT, authenticated and unauthenticated testing within scope.
• Lead internal and external network VAPT, validate external attack surface.
• Perform Microsoft 365 security assessments and verify vulnerabilities.
• Design and execute adversary-simulation scenarios and red-team objectives.
• Document attack paths, controls that failed, and remediation recommendations.
• Support ISO 27001 security-control assessments and present findings.

Skills

Web app VAPT

Microsoft 365 security

AD security

Windows security

Linux security

OWASP testing

MITRE ATT&CK

ISO 27001 controls

Risk reporting

Tools

Burp Suite

Kali Linux

Nmap

Nessus

Wireshark

BloodHound

Microsoft security tooling

AlgoSec

BAS platforms

Job description

KEY RESPONSIBILITIES

Vulnerability Assessment & Penetration Testing (VAPT)

Conduct comprehensive web application VAPT, performing authenticated and unauthenticated testing within the approved scope.

Conduct and oversee internal and external network VAPT, assessing network devices, infrastructure services and exposed services, and validating the external attack surface.

Conduct Microsoft 365 security assessments, including identity and configuration-related exposure.

Validate vulnerabilities and minimise false positives.

Provide risk-rated findings with evidence and clear remediation recommendations.

Perform remediation verification and closure testing.

Adversary Simulation / Red Teaming

Design and execute controlled adversary-simulation scenarios, such as:

• Lost corporate laptop objective: reach DR resources.
• Lost privileged administrator laptop objective: demonstrate potential domain-level impact.
• Lost executive laptop objective: access defined executive-sensitive information.
• Lost mobile phone objective: demonstrate whether Microsoft 365 / cloud access can be obtained.
• Malicious USB – objective: establish controlled internal access.
• Unmanaged / BYOD laptop – objective: determine whether corporate access can be pivoted from an unmanaged endpoint.

Test, subject to written authorisation: endpoint security controls, credential exposure, local privilege escalation, identity compromise, network access controls, VPN access exposure, privileged account paths, authentication weaknesses, segmentation controls, lateral movement opportunities, and access paths toward critical / DR infrastructure.

Document the complete attack path, the security controls that stopped the attack, the controls that failed, and the recommended mitigations.

Security-Control Assessments

Support technical security-control assessments aligned with ISO 27001.

Perform firewall, network-segmentation and security-policy assessments.

Present findings and recommendations clearly to technical teams and senior management.

REQUIREMENTS

• 8+ years of strong, hands‑on web application VAPT experience.
• 5+ years of Microsoft 365 / Entra ID security assessment experience.
• 5+ years of Active Directory security experience.
• Strong knowledge of Windows and Linux security and privilege‑escalation techniques.
• Experience in network segmentation and firewall / security-policy assessment.
• Strong understanding of the OWASP testing methodology and vulnerability validation.
• Familiarity with the MITRE ATT&CK framework.
• Technical knowledge of ISO 27001 security controls.
• Excellent report‑writing and customer presentation skills.

Must hold at least one of the penetration‑testing certifications listed below (mandatory).

TOOLS (PREFERRED)

• Burp Suite, Kali Linux, Nmap, Nessus and Wireshark.
• BloodHound or equivalent Active Directory assessment tooling.
• Microsoft security assessment tooling.
• AlgoSec and Breach & Attack Simulation (BAS) platforms.

CERTIFICATIONS (MANDATORY)

Candidates must hold at least one (1) of the following certifications:

• OSCP / OSCE3 / OSEP
• CRTO / CRTP
• CREST Pentest certifications (e.g. CRT, CCT INF, CCT APP)
• eWPT / eWPTX
• Any Penetration Testing certification accepted under the Dubai CyberForce Program (DESC / CREST), such as CRT, OSCP, ECSA, LPT, GPEN, GWAPT, CCT INF, CCT APP, OSEP, OSWE or GXPN.