Cybersecurity Offensive Security Specialist

International Turnkey Systems - ITS; Kuwait City; On-site; KWD 28,000 - 45,000; Full time

Job summary

International Turnkey Systems (ITS) is seeking a Cybersecurity Offensive Security Specialist to conduct advanced security assessments across web apps, APIs, mobile apps, networks, cloud, IoT and OT. You will simulate real-world cyberattacks and provide actionable remediation to improve our security posture.

You will lead red team exercises, perform external/internal penetration testing, and deliver high-quality reports to technical and business stakeholders, guiding remediation and validation

Qualifications

• 4+ years of hands-on penetration testing experience.
• Experience in Red Teaming, Web Application Security, API Security Testing, Mobile Security Assessments, IoT/OT Security Assessments.
• Bachelor's degree in a cybersecurity-related field.

Responsibilities

• Conduct advanced red team exercises simulating real-world threat actors.
• Perform external and internal penetration testing across networks and systems.
• Assess web applications and APIs for OWASP/secure coding weaknesses.
• Evaluate mobile app security (Android/iOS) and IoT/OT device security.
• Produce high-quality security assessment reports and present findings to stakeholders.

Skills

Red Teaming

Threat Emulation

Penetration Testing Methodologies

MITRE ATT&CK

Cyber Kill Chain

Scripting & Automation

Education

Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field

Tools

Burp Suite Professional

Postman

JWT, OAuth2, OpenID Connect

MobSF

Frida

Objection

APKTool

JADX

Burp Suite Mobile Testing

Job description

The Cybersecurity Offensive Security Specialist is responsible for conducting advanced security assessments, penetration testing, red team operations, and security reviews across web applications, APIs, mobile applications, networks, cloud environments, IoT devices, and Operational Technology (OT) systems. The role focuses on identifying vulnerabilities, validating security controls, simulating real-world cyberattacks, and providing actionable remediation recommendations to improve the organization’s security posture.

Key Responsibilities

Red Teaming & Adversary Emulation

• Conduct advanced red team exercises simulating real-world threat actors.
• Execute attack scenarios aligned with MITRE ATT&CK framework.
• Perform phishing campaigns, credential attacks, social engineering simulations, and lateral movement exercises.
• Assess cyber defense effectiveness including SOC, SIEM, EDR
• Develop custom attack techniques and proof-of-concept exploits.
• Conduct Purple Team exercises with security monitoring teams.

Penetration Testing

External & Internal Infrastructure

• Perform black-box, gray-box, and white-box penetration testing.
• Assess internal and external network environments.
• Identify vulnerabilities in:
• Active Directory
• Windows and Linux systems
• Databases
• Virtualization environments
• Cloud platforms
• Validate remediation effectiveness through re-testing activities.

Web Application Security Assessments

• Conduct security assessments against web applications using OWASP Testing Methodology.
• Identify vulnerabilities including:
• SQL Injection
• Cross-Site Scripting (XSS)
• Authentication flaws
• Session management weaknesses
• CSRF
• Access control issues
• File upload vulnerabilities
• Business logic flaws
• Perform manual exploitation and validation of findings.
• Review security architecture and secure coding controls.

API Security Assessments

• Conduct security testing of REST, SOAP, GraphQL, and Microservices APIs.
• Identify:
• Broken Object Level Authorization (BOLA)
• Broken Authentication
• Excessive Data Exposure
• SSRF Vulnerabilities
• Insecure Direct Object References
• JWT Security Weaknesses
• API Abuse Scenarios
• Assess API Gateway implementations and security controls.
• Review API documentation and specifications.

Mobile Application Security Assessments

Android

• Perform static and dynamic security assessments.
• Analyze APK packages and mobile application architecture.
• Evaluate local storage security, cryptography implementation, and backend integrations.

iOS

• Assess iOS application security controls.
• Perform runtime security analysis.
• Test jailbreak protections and application hardening mechanisms.

Mobile Security Areas

• Reverse engineering
• SSL Pinning bypass testing
• Data leakage assessments
• Secure storage validation
• Root/Jailbreak detection testing
• Mobile API security testing

IoT Security Assessments

• Conduct security assessments of Internet of Things (IoT) devices.
• Evaluate:
• Device firmware security
• Wireless communication protocols
• Authentication mechanisms
• Device hardening controls
• Embedded operating systems
• Perform firmware extraction and analysis.
• Identify insecure configurations and exposed services.

Security Reporting & Stakeholder Engagement

• Produce high-quality technical and executive security assessment reports.
• Present findings to technical and business stakeholders.
• Provide practical remediation recommendations.
• Assist asset owners with vulnerability remediation planning.
• Track remediation progress and perform validation testing.

Required Technical Skills

Offensive Security

• Red Team Operations
• Threat Emulation
• Penetration Testing Methodologies
• MITRE ATT&CK
• Cyber Kill Chain

Web & API Security

• OWASP Top 10
• OWASP API Security Top 10
• Burp Suite Professional
• Postman
• JWT, OAuth2, OpenID Connect

Mobile Security

• MobSF
• Frida
• Objection
• APKTool
• JADX
• Burp Suite Mobile Testing

Infrastructure Security

• Active Directory Security
• Windows Security
• Linux Security
• Network Security
• Wireless Security

IoT & OT Security

• Embedded Device Security
• Firmware Analysis

Scripting & Automation

• Python
• PowerShell
• Bash
• API Automation

Education

• Bachelor\'s Degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field.

Experience

• 4+ years of hands‑on penetration testing experience.
• Proven experience in:
• Red Teaming
• Web Application Security
• API Security Testing
• Mobile Security Assessments
• IoT/OT Security Assessments

Preferred Certifications

Essential (One or More)

• OSCP
• PNPT
• CRTO
• OSEP
• OSWE
• eWPTX
• eMAPT
• GMOB
• GICSP
• GRID
• GPEN
• GWAPT
• CARTP