Senior Offensive Security Engineer

Digitem Technologies; Delhi; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

Digitem Technologies in Delhi/Gurugram is seeking a Senior Offensive Security Engineer to lead adversary emulation and advanced offensive security operations. You will drive red-team campaigns across hybrid environments, and mentor junior engineers while communicating findings to executives.

You will work on CI/CD security, hardware IoT security, and custom C2 efforts, translating complex attack paths into actionable security roadmaps for the organization.

Qualifications

• 3–8 years of offensive security experience with leading red team operations or adversary emulation.
• Strong knowledge of SDLC, DevSecOps and software supply chains.
• Hands-on hardware reverse engineering and IoT security experience.
• Proficient in low-level programming or scripting (C/C++, Go, Python).
• Ability to analyze CTI and map TTPs to enterprise defenses.

Responsibilities

• Lead Red Team operations: scope, design and run global adversary campaigns.
• Coordinate CI/CD/DevSecOps exploitation across modern pipelines (GitHub Actions, GitLab CI, Jenkins).
• Assess security of IoT devices and embedded systems including firmware analysis.
• Architect and operate covert C2 infrastructure with advanced redirectors.
• Translate attack paths into executive risk reports for leadership.
• Mentor junior engineers and drive R&D initiatives.

Skills

Red Team Leadership

DevSecOps

Adversary Emulation

Threat Modeling

Mentorship

Tools

Kubernetes

Docker

HashiCorp Vault

AWS Secrets Manager

Jenkins

Job description

Job Title: Senior Offensive Security Engineer
Department: Corporate Security / Offensive Security
Experience Level: 3-8 Years
Employment Type: Full-time
Location: Delhi/ Gurugram, On-Site
Position Summary
We are seeking an elite, highly autonomous Senior Offensive side of Security Engineer to lead our adversary emulation and advanced offensive security operations.
With 38 years of dedicated offensive security experience, your scope goes far beyond standard network penetration testing. You will lead exercices to find out vulnerabilities to exploit modern DevSecOps architectures, compromise CI/CD software supply chains and target enterprise IoT/hardware ecosystems. Beyond executing technical operations, you will serve as a strategic leadermentoring junior engineers, collaborating directly with executive leadership and translating red team findings into measurable enterprise defensive roadmaps.

Key Responsibilities

• Lead Red Team Operations: Scope, design and lead end-to-end global adversary emulation campaigns targeting complex enterprise infrastructure, hybrid cloud environments, supply chains and specialized hardware.
• CI/CD & DevSecOps Exploitation: Orchestrate attack and exploit modern DevOps pipelines (e.g., GitHub Actions, GitLab CI, Jenkins). Inject malicious code, abuse runner configurations, exploit infrastructure-as-code (IaC) misconfigurations and hijack software supply chains to pivot into production environments.
• IoT : Perform physical and logical security assessments on enterprise IoT devices, embedded systems and proprietary hardware. Execute firmware reverse engineering, extract cryptographic keys and abuse hardware communication protocols (e.g., UART, JTAG, SPI) to gain network footholds.
• Custom Infrastructure & C2 Construction: Architect, deploy and manage highly resilient, covert Command-and-Control (C2) infrastructure using advanced redirectors, domain fronting and custom C2 frameworks (e.g., Cobalt Strike, Mythic, Sliver).
• Executive Reporting & Risk Communication: Translate highly technical, multi-step attack paths into impactful executive summaries and risk reports for C-level executives (CISO/CIO) to drive security budget and architecture decisions.
• Mentorship & Leadership: Act as a technical mentor to junior and mid-level pentesters/red teamers, establishing methodologies, peer-reviewing report quality and driving the teams research and development (R&D) efforts.

Required Skills & Qualifications

• Experience: 3-8 years of dedicated experience in offensive security roles, with a proven track record of leading complex Red Team operations or advanced adversary emulation engagements.
• DevSecOps & Supply Chain Mastery: Deep understanding of modern software development life cycles (SDLC). Proven ability to compromise secrets management vaults (e.g., HashiCorp Vault, AWS Secrets Manager), poison build environments and abuse container orchestrators (Kubernetes, Docker).
• IoT & Embedded Security Skills: Hands-on experience with hardware reverse engineering, debugging firmware and utilizing hardware hacking tools (e.g., Bus Pirate, Logic Analyzers, JTAGulators).
• Expert Evasion Techniques: Advanced knowledge of Windows/Linux internals, API unhooking, direct system calls (Syscalls), process injection and memory patching to evade top-tier EDR and SIEM platforms.
• Software Development Mastery: Proficient in low-level programming or deep scripting languages (e.g., C/C++, C#, Go, Python) for custom tool building, reverse engineering, and exploit refinement.
• Threat Intelligence Integration: Ability to analyze Cyber Threat Intelligence (CTI) reports and reverse-engineer real-world threat actor TTPs (Tactics, Techniques, and Procedures) to replicate specific adversary groups.

Preferred Certifications

• DevSecOps/Cloud: Certified DevSecOps Professional (CDP) or PACES (Professional Azure Security Expert)
• OffSec: OSEP (OffSec Experienced Pentester) or OSED (OffSec Exploitation Developer)
• Altered Security: CRTE (Certified Red Team Expert)
• SANS / GIAC: GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)