Service Operations Specialist

Nokia; Dadri; On-site; INR 2,000,000 - 4,000,000; Full time

Job summary

Nokia is seeking a highly skilled Offensive Security professional to lead Red Team operations, web and API security testing, and mobile app assessments. You will simulate real-world cyberattacks, identify weaknesses across applications and infrastructure, and guide remediation with development and security teams.

Responsibilities include adversary emulation, CI/CD integration of DAST, and comprehensive reporting with actionable findings.

Qualifications

• 5+ years of hands-on experience in Pen testing, Red Teaming, or Offensive Security.
• Strong expertise in Web Application Security and API Security; OWASP Top 10 & API Top 10.
• Experience with network security, Active Directory security, and cloud infrastructure.
• Proficiency with MITRE ATT&CK framework and secure SDLC concepts.

Responsibilities

• Conduct adversary emulation exercises and Red Team engagements.
• Execute attack simulations against enterprise environments and critical applications.
• Perform web app and API security assessments, including REST, SOAP, GraphQL, and microservices.
• Deliver executive reports with attack paths, impact analysis, and remediation guidance.

Skills

Penetration Testing

Web & API Security

Network Security

Cloud Security

Red Team Tools

Tools

Burp Suite

OWASP ZAP

Nmap

Metasploit

BloodHound

Cobalt Strike

Kali Linux

MobSF

Frida

Kubernetes

Docker

Job description

We are seeking a highly skilled Offensive Security professional with expertise in Red Team Operations, Application Security Testing, API Security Assessment, Mobile Application Penetration Testing, and Dynamic Application Security Testing (DAST). The role involves simulating real-world cyberattacks, identifying security weaknesses across applications and infrastructure, and providing actionable remediation guidance to development and security teams.

HOW YOU WILL CONTRIBUTE AND WHAT YOU WILL LEARN

• Conduct adversary emulation exercises and Red Team engagements.
• Execute attack simulations against enterprise environments, Active Directory, cloud infrastructure, and critical business applications.
• Perform reconnaissance, initial access, privilege escalation, persistence, lateral movement, and data exfiltration simulations.
• Assess effectiveness of SOC, SIEM, EDR, XDR, MDR, and Incident Response capabilities.
• Develop custom attack scenarios based on MITRE ATT&CK framework.
• Deliver executive and technical reports with attack paths, impact analysis, and remediation recommendations.
• Perform manual and automated security assessments of web applications.
• Identify and exploit vulnerabilities including:
  • SQL Injection
  • Cross-Site Scripting (XSS)
  • CSRF
  • SSRF
  • Broken Authentication
  • Authorization Bypass
  • Business Logic Flaws
  • File Upload Vulnerabilities
• Perform REST, SOAP, GraphQL, and Microservices API security assessments.
• Evaluate APIs against OWASP API Security Top 10.
• Identify vulnerabilities such as:
  • Broken Object Level Authorization (BOLA)
• Conduct Android and iOS application security assessments.
• Perform static and dynamic analysis of mobile applications.
• Assess:
  • Local Data Storage Security
• Configure and execute DAST scans across web applications and APIs.
• Validate and triage findings.
• Integrate DAST into CI/CD and DevSecOps pipelines.
• Assist development teams in remediation and secure coding practices.

Qualifications

Must-Have Skills:

1. Offensive Security / Penetration Testing
   • 5+ years of hands-on experience in Penetration Testing, Red Teaming, or Offensive Security.
   • Strong understanding of adversary simulation and attack methodologies.
2. Web & API Security
   • Strong expertise in Web Application Security and API Security.
   • OWASP Top 10 and OWASP API Top 10.
   • Hands-on experience with Burp Suite, OWASP ZAP and similar tools.
3. Network & Active Directory Security
   • Network penetration testing and vulnerability assessment.
   • Hands-on experience with Nmap, Metasploit, BloodHound, Cobalt Strike/equivalent.
   • Knowledge of Active Directory attack techniques.
4. Cloud & Infrastructure Security
   • Hands-on security testing across Azure, AWS and/or GCP.
   • Understanding of cloud attack paths, IAM, misconfigurations and cloud-native security.
5. Red Team Tools, Scripting & Security Frameworks
   • Strong hands-on experience with Kali Linux and offensive security tooling.
   • Ability to develop attack/automation scripts using Python, PowerShell or Bash.
   • Working knowledge of MITRE ATT&CK, Secure SDLC and NIST CSF.

Good-to-have skills:

• Mobile & Advanced Application Security
  • Mobile penetration testing using MobSF, Frida.
  • Secure code review and advanced application security testing.
• Cloud Red Teaming & Container Security
  • Cloud Red Teaming across Azure/AWS/GCP.
  • Kubernetes, Docker and container security experience.
• DevSecOps & CI/CD Security
  • Integration of security testing into CI/CD pipelines.
  • DAST, threat modeling and DevSecOps practices.
• Purple Teaming & Adversary Emulation
  • Experience conducting Purple Team exercises.
  • Advanced adversary emulation and MITRE ATT&CK-based assessments.
• Industry Certifications
  • Preferred: OSCP, OSEP, OSWE, CRTO, CRTP, PNPT, CISSP, GWAPT, GPEN, GMOB, GXPN or AZ-500.