Infra Penetration Testing @ Mumbai

Quess IT Staffing; Navi Mumbai; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Quess IT Staffing is seeking an experienced Infra Penetration Tester to perform hands-on infrastructure assessment in Navi Mumbai. The role involves using Metasploit, Kali Linux, and related tools to identify weaknesses, validate vulnerabilities, and propose remediation steps.

This contract-to-hire position demands strong scripting ability and proficiency with AD security tooling. The successful candidate will work on exploitation frameworks, post-exploitation techniques, and risk-based findings

Qualifications

• Min 3–8 years hands-on experience in infrastructure penetration testing.
• Experience with exploit frameworks and post-exploitation techniques.
• Familiarity with vulnerability validation, remediation revalidation, and risk-based prioritization.

Responsibilities

• Perform infrastructure penetration testing using industry-standard tools (Metasploit, Kali Linux).
• Identify, validate, and remediate vulnerabilities across networks and AD environments.
• Document findings with clear, actionable recommendations and PSOT for safe PoC development.

Skills

Penetration testing

Threat emulation

Scripting

Vulnerability assessment

Tools

Metasploit

Cobalt Strike

Kali Linux

Nessus

Nmap

Shodan

BloodHound

Impacket

Mimikatz

Rubeus

Hashcat

John the Ripper

Hydra

CrackMapExec

MISP

Recorded Future

Mandiant

ASM

ProjectDiscovery

Python

PowerShell

Job description

Position: Infra Penetration Testing

Location: Navi Mumbai

Duration: Contract to Hire

Job Description:

Experience: Min 3 - 8 years hands-on experience

Tech-Stack & Skills:

• Metasploit / Cobalt Strike / Kali Linux – infrastructure penetration testing, exploitation frameworks & post-exploitation techniques
• Tenable.io / Tenable.SC / Nessus – vulnerability validation, exploit confirmation & remediation revalidation scanning
• Nmap / Masscan / Shodan / Censys – network reconnaissance, service enumeration, exposed-service identification & attack-surface mapping
• Active Directory Security (BloodHound / Impacket / Mimikatz / Rubeus) – AD attack-path analysis, Kerberoasting & privilege escalation
• Password Auditing (Hashcat / John the Ripper / Hydra / CrackMapExec) – credential assessment & weak-password validation
• Threat Intelligence Platforms (MISP / Recorded Future / Mandiant) – exploit-intel correlation, advisory-driven PT & threat-informed testing
• Attack Surface Management (Mandiant ASM / Censys / ProjectDiscovery) – external exposure analysis & attack-path refinement
• Python / Bash / PowerShell – custom exploit scripting, PT automation & safe PoC development
• MITRE ATT&CK / PTES / OSSTMM / NIST SP 800-115 – TTP mapping, adversary emulation & structured PT methodology
• CVSS v3.1 / EPSS – risk-based finding prioritization, executive reporting & purple team coordination with SOC