Senior Engineer - Penetration Tester

Rakuten Symphony; Bengaluru; On-site; INR 3,500,000 - 6,000,000; Full time

Job summary

Rakuten Mobile Security Assurance in India seeks a Senior Penetration Tester to perform advanced offensive security assessments across web, mobile, API, cloud, AI/ML, and telecom environments. This role focuses on identifying complex vulnerabilities, validating exploits, and supporting red team activities.

You will work with 4G/5G telecom platforms, cloud-native infra, and AI-assisted testing, developing PoCs, reports, and remediation guidance.

Qualifications

• 10+ years of hands-on penetration testing and application security experience.
• Strong expertise in web, mobile, API, cloud, infrastructure, and AI security testing.
• Experience with Burp Suite, Kali Linux, Metasploit, BloodHound, Nmap, Nessus, and modern offensive security frameworks.
• Knowledge of programming and scripting languages such as Python, JavaScript, Bash, and PowerShell.
• Familiarity with cloud platforms such as AWS, Azure, or GCP and containerized environments such as Kubernetes and Docker.

Responsibilities

• Conduct manual and automated penetration testing of web apps, mobile apps, APIs, cloud, and networks.
• Assess AI/ML applications, LLM-based systems, AI agents, and MLOps pipelines.
• Identify vulnerabilities like prompt injection, insecure integrations, data leakage, and AI supply chain risks.
• Support red team exercises, adversary emulation, attack path analysis, and exploit validation.
• Perform source code reviews, secure design reviews, and architecture-level security assessments.
• Develop PoCs, produce detailed technical reports, and provide remediation guidance.
• Validate fixes and re-test to confirm closure.
• Research emerging attack techniques and AI-assisted testing methods.
• Contribute to automation and continuous security validation initiatives.

Skills

Penetration testing

Web/mobile/API security

Cloud security testing

AI security testing

Programming: Python/JavaScript/Bash/PS

Kubernetes & Docker

Tools

Burp Suite

Kali Linux

Metasploit

BloodHound

Nmap

Nessus

Job description

Job Description:

Job Title: Senior Penetration Tester(Sr. Penetration Tester)
Department: Security Assurance
Reports To: Senior Manager, Security Assurance Section
Location: Bangalore or Indore, India

About the Team/Department:

At Rakuten Mobile Security Assurance, you will help secure one of the world's most advanced cloud-native telecom networks, protecting millions of customers across digital, mobile, cloud, and AI-driven services.

You will work on cutting-edge offensive security challenges spanning 4G/5G telecom platforms, cloud-native infrastructure, applications, APIs, AI/ML systems, and emerging technologies.

We offer an environment where innovation is encouraged, continuous learning is supported, and security experts are empowered to make a direct business impact.

You will have the opportunity to work alongside industry-leading engineers, build next-generation security capabilities, leverage AI to transform security testing, and contribute to protecting critical telecommunications infrastructure at scale.

If you are passionate about offensive security, enjoy solving complex technical challenges, and want to shape the future of cybersecurity in the AI era, we would love to hear from you.

Position Summary

Perform advanced penetration testing and offensive security assessments across Rakuten Mobile's web, mobile, API, cloud, AI/ML, and telecom environments. The role focuses on identifying complex security vulnerabilities, validating exploitability, supporting red team activities, and helping engineering teams strengthen the organization's security posture.

Key Responsibilities

• Conduct manual and automated penetration testing of web applications, mobile applications, APIs, cloud platforms, and network infrastructure.
• Perform security assessments of AI/ML applications, LLM-based systems, AI agents, RAG implementations, and MLOps pipelines.
• Identify vulnerabilities such as prompt injection, insecure model integrations, data leakage, model manipulation, and AI supply chain risks.
• Execute security testing of telecom systems, including BSS/OSS applications, eSIM platforms, subscriber management systems, mobile network services, and internet-facing telecom applications.
• Support red team exercises, adversary emulation engagements, attack path analysis, and exploit validation.
• Conduct source code reviews, secure design reviews, and architecture-level security assessments when required.
• Develop proof-of-concepts, create detailed technical reports, and provide actionable remediation recommendations.
• Validate remediation fixes and perform security re-testing to confirm closure.
• Research emerging attack techniques, exploit methodologies, AI-assisted testing methods, and offensive security tools.
• Contribute to automation initiatives and continuous security validation capabilities.

Required Qualifications

• 10+ years of hands-on penetration testing and application security experience.
• Strong expertise in web, mobile, API, cloud, infrastructure, and AI security testing.
• Experience with Burp Suite, Kali Linux, Metasploit, BloodHound, Nmap, Nessus, and modern offensive security frameworks.
• Knowledge of programming and scripting languages such as Python, JavaScript, Bash, and PowerShell.
• Familiarity with cloud platforms such as AWS, Azure, or GCP and containerized environments such as Kubernetes and Docker.

Preferred Qualifications

• Experience with telecom technologies, mobile core networks, BSS/OSS systems, and cloud-native telecom applications is preferred.
• Preferred certifications: OSCP, CRTP, CRTO, OSEP, OSWE, GPEN, GXPN or equivalent certifications.

Nice-to-Have Expertise

• AI/LLM security testing and adversarial machine learning.
• Red team operations and advanced exploit development.
• Cloud and Kubernetes security assessments.
• 5G / telecom security testing and BSS/OSS security validation.
• Bug bounty, vulnerability research, and AI-assisted penetration testing.

Core Competencies

• Advanced Offensive Security - Conducts complex manual penetration tests, exploit validation, and attack-path analysis.
• Application and API Security - Assesses web, mobile, API, source-code, and application architecture risks.
• Cloud and Infrastructure Security - Tests AWS/Azure/GCP, Kubernetes, containers, networks, identity systems, and configurations.
• AI/ML Security Testing - Evaluates LLMs, AI agents, RAG solutions, MLOps pipelines, and AI supply-chain risks.
• Telecom Security Expertise - Understands 4G/5G, BSS/OSS, eSIM, subscriber platforms, and cloud-native telecom environments.
• Red Teaming and Adversary Emulation - Applies realistic attacker techniques and supports advanced offensive-security exercises.
• Security Automation and Scripting - Uses Python, JavaScript, Bash, or PowerShell to automate testing and validation.
• Analytical Problem-Solving - Investigates complex systems, prioritizes exploitable risks, and develops practical proofs of concept.
• Risk Communication and Reporting - Clearly explains technical findings, business impact, and actionable remediation to technical and nontechnical stakeholders.
• Collaboration and Technical Leadership - Works effectively with engineering teams, mentors others, and drives remediation through closure.
• Continuous Learning and Innovation - Tracks emerging attack techniques, vulnerabilities, tools, and AI-assisted testing methods.
• Professional Ethics and Accountability - Handles sensitive information responsibly and performs testing within authorized scope.
• undefined