Cyber security - Penetration Testing

Cloudxtreme; Hyderabad, Bengaluru; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Cloudxtreme is seeking an experienced penetration tester to perform hands-on manual assessments across web and mobile apps, APIs, networks, and thick clients. You will scope engagements, identify vulnerabilities, and provide actionable remediation guidance to stakeholders.

The role emphasizes practical testing, clear communication, and continuous learning with tools like Burp Suite, ZAP, Metasploit, and Kali Linux. Global delivery experience and AI-assisted testing are a plus.

Qualifications

• Hands-on manual testing required for web and mobile apps.
• Proficient with Burp Suite, OWASP ZAP, Metasploit, Postman, Swagger, SQLMap.
• Kali Linux experience; strong testing across web services, networks and apps.
• Certifications such as OSCP/OSWE/OSTP are a plus.

Responsibilities

• Assist in technical scoping of security testing activities and architectures.
• Execute manual penetration testing across domains: Web apps, Mobile apps, Web Services/APIs, Network, Thick client.
• Conduct focused security research when not on active engagements.
• Analyze complex architectures to identify weaknesses and attack paths.
• Provide risk-based remediation guidance, in writing and verbally.
• Prepare high-quality reports with concise risk articulation and recommendations.
• Maintain and update testing methodologies, playbooks, and standards.

Skills

Web app testing

Mobile app testing

API testing

Network testing

Thick client testing

Tools

Burp Suite

OWASP ZAP

Metasploit

Postman

Swagger

Nmap

Qualys

SQLMap

Kali Linux

Job description

Role & responsibilities

Role-Specific Expertise Requirements :

• Candidates must demonstrate strong manual pen testing skills in both web applications and mobile (preferably Android and iOS).
• Basic tool-driven testing (like MobSF scans) is insufficient; hands-on manual testing experience is mandatory.
• Networking knowledge is preferred but thick client testing is not currently required.
• Any certification is not mandatory
• Screening must include verifying years of relevant experience and number of completed manual assessments.
• Execute manual penetration testing across multiple domains, including:
  • Web Application Penetration Testing
  • Mobile Application Penetration Testing
  • Web Services / API Penetration Testing
  • Network Penetration Testing
  • Thick Client Penetration Testing

Key Responsibilities

• Assist in the technical scoping of security testing activities based on client requirements and architecture reviews.
• Execute manual penetration testing across multiple domains, including:
  • Web Application Penetration Testing
  • Mobile Application Penetration Testing
  • Web Services / API Penetration Testing
  • Network Penetration Testing
  • Thick Client Penetration Testing
• Conduct focused security research when not deployed on active engagements.
• Analyze and understand complex application, infrastructure, and solution architecture designs to identify security weaknesses.
• Provide consultative guidance to stakeholders on vulnerabilities identified, including clear and actionable remediation recommendations, both verbally and in writing.
• Prepare high-quality assessment reports with concise risk articulation and business-relevant recommendations.
• Enhance and update penetration testing methodologies, processes, playbooks, and standards documentation.
• Maintain technical proficiency through ongoing learning, certifications, and structured training paths.
• Effectively communicate the services, capabilities, and value proposition of the penetration testing team to internal and external stakeholders.
• Leverage automation and scripting, including AI-assisted and AI-integrated approaches, to improve testing efficiency and coverage.
• Support vulnerability research and exploit development activities using AI-enabled techniques where appropriate.
• Perform security testing for LLM-enabled applications and AI systems, including validation of common LLM-related risks and misuse scenarios.

• Exposure to AI-assisted security testing, AI-supported exploit research, or AI-integrated offensive security workflows. Experience in LLM security testing, prompt injection testing, model misuse scenarios, and security assessment of AI-enabled applications. Relevant industry certifications such as OSCP, OSWE, OSEP, GPEN, GWAPT, GMOB, eCPPT, or equivalent. Familiarity with secure development practices and remediation validation. Experience working in global delivery models and supporting diverse stakeholder groups. . Key Responsibilities Lead and support technical scoping of penetration testing and offensive security activities based on business needs, architecture, and risk profile. Perform advanced manual penetration testing across:
  • Web Applications
  • Mobile Applications
  • Web Services / APIs
  • Network environments
  • Thick Client applications
  Assess complex application and infrastructure architectures to identify attack paths, design weaknesses, and security gaps. Validate vulnerabilities through hands-on testing and clearly distinguish exploitable findings from false positives. Provide consultative, risk-based guidance to clients and stakeholders on identified findings, including practical remediation recommendations in both verbal and written formats. Develop high-quality technical reports and executive-ready summaries that clearly articulate risk, business impact, and corrective actions. Conduct focused security research, vulnerability analysis, and exploit validation when not deployed on active engagements. Contribute to the enhancement of penetration testing methodologies, standards, playbooks, and internal processes. Maintain and expand technical proficiency through continuous learning, certifications, research, and training. Communicate team services and capabilities effectively to internal stakeholders and clients across global environments. Apply automation and scripting, including AI-assisted and AI-integrated techniques, to improve testing effectiveness and efficiency. Support emerging security testing areas such as AI-enabled applications, LLM security testing, and AI-assisted vulnerability research and exploit development. Manage multiple assignments concurrently, applying sound judgment to prioritize work, meet deadlines, and maintain quality. Required Qualifications To be considered for this role, candidates should demonstrate the following: Proven experience in manual Web Application Penetration Testing. Proven experience in manual Mobile Application Penetration Testing.
• Hands-on experience in Web Services / API Penetration Testing. Hands-on experience in Network Penetration Testing. Hands-on experience in Thick Client Penetration Testing. Strong experience with common security testing tools such as Burp Suite, OWASP ZAP, Metasploit, Postman, Swagger, Nmap, Qualys, SQLMap, and similar tools. Experience using Kali Linux or other dedicated penetration testing operating system platforms. Advanced knowledge of network penetration testing, application penetration testing, and architectural security principles. Familiarity with software security weaknesses, common vulnerability classes, and attack techniques. Working knowledge of at least one scripting language such such as Python, Bash, or PowerShell. Familiarity with at least one programming language and framework, enabling effective review and testing of application behavior. Strong written and verbal communication skills, including the ability to explain complex technical issues to varied audiences. Demonstrated experience working with diverse stakeholders, ideally in a global, multi-national environment. Ability to manage concurrent initiatives with effective prioritization, sound judgment, and strong time management. Preferred Qualifications The following would be advantageous: Knowledge of or experience with:
  • OWASP Top 10
  • OWASP API Security Top 10
  • OWASP Thick Client Top 10
  • OWASP LLM Top 10
  • MITRE ATT&CK Framework
  Experience in cloud service testing. Exposure to reverse engineering techniques. Familiarity with Static Application Security Testing (SAST). Familiarity with Dynamic Application Security Testing (DAST). Relevant certifications such as OSCP, OSWE, OSEP, GPEN, GWAPT, GMOB, eCPPT, or equivalent. Experience with AI-assisted testing workflows, security assessment of LLM-enabled applications, or modern offensive security automation approaches.