Contract: Sr. Offensive Security Engineer - Azure Entra ID

Applaudo; Colombia; On-site; COP 261,545,000 - 435,908,000; Part time

Job summary

Applaudo is seeking an offensive security professional to perform identity and cloud boundary testing across two Azure tenants. You will start from approved footholds, escalate privileges through Entra ID and Azure RBAC, and document each step with reproducible evidence while keeping actions controlled and reversible.

You will explain attack paths to cloud admins, produce regulator-ready reporting, and remove all artifacts before testing ends.

Qualifications

• Proven end to end offensive security experience across reconnaissance, exploitation, privilege escalation, lateral movement and reporting.
• Offensive testing of Microsoft Entra ID and Azure RBAC, including managed identities and service principals.
• Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.
• Cross subscription and cross tenant attack path analysis, plus Active Directory privilege escalation and lateral movement.

Responsibilities

• Lead identity and Azure boundary assumed breach testing across two Azure tenants.
• Start from approved footholds, including a standard user with MFA, a workload identity credential or a shell on Azure compute, and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities and service principals.
• Attempt movement between approved subscriptions and between tenants, and assess whether separation controls hold.
• Attempt to reach secrets, keys, tokens and stores of nonpublic information in Key Vault, Storage and databases.
• Assess AKS workloads where authorized, including workload identity abuse and pod to node escalation.
• Chain cloud findings with application layer findings, for example moving from a compromised application to its workload identity, to demonstrate end to end attack paths.
• Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant wide settings.
• Report each objective as achieved, with the attack path and supporting evidence, or blocked, with what stopped the attempt, and report posture only observations separately as untested.
• Remove all created artifacts, including app registrations, role assignments and credentials, before testing ends.
• Retest remediated attack paths and contribute to the revalidation report.
• Escalate stop conditions within one hour and execute all testing without service disruption or data loss.

Skills

End-to-end pentesting

Entra ID testing

Azure RBAC privilege escalation

Token abuse

Azure offensive tooling

Attack path analysis

AD/Windows Priv Esc

Cloud PenTesting ROE

CVSS reporting

Controlled testing

Timestamped record keeping

English communication

Education

Bachelor’s degree or equivalent

Tools

ROADtools

AzureHound/BloodHound

AADInternals

MicroBurst

GraphRunner

Job description

Applaudo is seeking an offensive security professional to perform identity and cloud boundary testing across two Azure tenants. You will start from approved footholds, escalate privileges through Entra ID and Azure RBAC, and document each step with reproducible evidence while keeping actions controlled and reversible.

You will explain attack paths to cloud admins, produce regulator-ready reporting, and remove all artifacts before testing ends.