Sr Engineer Red Team

etisalat UAE; Dubai; On-site; AED 180,000 - 280,000; Full time

Job summary

etisalat UAE is seeking a senior security professional to perform red team assessments, threat modeling and adversarial testing across web, API, mobile and network layers. You will design and execute offensive security campaigns, use OSINT, C2s, and social engineering to simulate real-world threats, and report findings with actionable mitigations.

The role requires hands-on testing, reverse engineering, and malware/EDR bypass experience.

Qualifications

• CEH or similar certification preferred.
• Hands-on web application and API penetration testing experience.
• Experience with mobile application security testing.
• Independent reconnaissance, attack-surface discovery and exploitation.
• Scripting, automation and technical problem-solving.
• End-to-end assessment ownership and technical reporting.
• Experience in reverse engineering (hardware or software).
• Experience with OAuth 2.0 like auth protocols and web PT.
• Experience in mobile PT and network PT including wireless.
• Experience with malware development and EDR bypass.

Responsibilities

• Compromise security by extracting information and infiltrating systems.
• Avoid blue team detection; assess attacker’s foothold and damage potential.
• Identify gaps in infrastructure and improve security posture.
• Lead hostile activity incl. advanced penetration testing for assessment.

Skills

CEH

OSINT

Penetration testing

Social engineering

PowerShell

Python

Exploit writing

Red team

Threat modeling

Tools

C2 server tools

Reverse engineering tooling

EDR bypass techniques

Job description

Job Description:

Job Description

Generate meaningful information from deep web or national entities or international entities about existing or emerging threats to mitigate risks and Identifying attack path that breaches organization's security.

Activity

RESPONSIBILITIES

• Compromising the target's security by extracting information, infiltrating its systems or breaching its physical perimeters.
• Avoiding detection by the blue team. Many attacks occur over a fleeting period of time, making it extremely tricky for the blue team to neutralize the threat before the 'damage' is done.
• Exploiting bugs and weaknesses in the target's infrastructure. This highlights gaps in the organization's technical security that require fixing, thus improving its security posture.
• Initiating hostile activity - including sophisticated penetration testing - giving a reliable assessment of the blue team's defensive capabilities.

Methodology

• Initial reconnaissance - open source intelligence (OSINT) for collecting information on the target.
• Deploying command-and-control servers (C&C or C2) to establish communication with the target's network.
• Using decoys to throw the blue team off the scent.
• Applying social engineering and phishing techniques to manipulate employees into exposing or revealing information to compromise their machines.
• Physical and digital penetration testing - typically done in a vacuum.

Qualifications

• Certified Ethical Hacker (CEH) or similar certifications preferred.
• Hands-on Web Application and API Penetration Testing.
• Practical Mobile Application Security Testing.
• Independent Reconnaissance, Attack-Surface Discovery, and Exploitation.
• Scripting, Automation and Technical Problem-Solving.
• End-to-End Assessment Ownership and Technical Reporting.
• Experience in Reverse Engineering (either or both hardware or software).
• Experience in Web Application PT including understanding of oAuth 2.0 like auth protocols.
• Experience in Mobile application PT.
• Experience in Mobile OS PT.
• Experience in Network PT (including Wireless PT).
• Experience in Thick Client PT.
• Experience in exploit writing especially in PowerShell, python.
• Experience in RFID and IoT based attacks and social engineering styled attacks.
• Experience with Windows AD red teaming with in-depth knowledge.
• Experience in any C2 server tool with in-depth knowledge.
• Experience with Malware Development and EDR Bypass.
• Experience with Bug Bounty programs, either as a triager or researcher, with strong skills in validating and assessing reported vulnerabilities.
• Experience on designing, deploying and operationalize AI Red Team projects, including setting up secure test environments and model sandboxes, building adversarial/prompt-injection tooling, running adversarial evaluations, and integrating results into engineering and CI/CD workflows.

Requirements: