Cybersecurity Offensive Security Specialist

International Turnkey Systems - ITS; Kuwait City; On-site; KWD 18,000 - 30,000; Full time

Job summary

International Turnkey Systems - ITS is seeking a Cybersecurity Offensive Security Specialist to conduct advanced security assessments, red team operations, and comprehensive security reviews across web apps, APIs, mobile apps, networks, cloud, IoT, and OT systems. You will identify vulnerabilities and provide actionable remediation guidance.

You will lead adversary emulation, perform phishing simulations, test with MITRE ATT&CK, review security controls, and deliver high-quality reports to

Qualifications

• 4+ years of hands-on penetration testing experience.
• Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field.

Responsibilities

• Conduct advanced red team exercises simulating real-world threat actors.
• Execute attack scenarios aligned with MITRE ATT&CK framework.
• Perform phishing campaigns, credential attacks, social engineering simulations, and lateral movement exercises.
• Assess cyber defense effectiveness including SOC, SIEM, EDR
• Develop custom attack techniques and proof-of-concept exploits.
• Conduct Purple Team exercises with security monitoring teams.
• Perform black-box, gray-box, and white-box penetration testing.
• Assess internal and external network environments.
• Identify vulnerabilities in Active Directory, Windows and Linux systems, Databases.
• Validate remediation effectiveness through re-testing activities.
• Conduct security assessments against web applications using OWASP Testing Methodology.
• Identify vulnerabilities including XSS, session management weaknesses, CSRF, access control issues, business logic flaws.
• Perform manual exploitation and validation of findings.
• Review security architecture and secure coding controls.
• Conduct security testing of REST, SOAP, GraphQL, and Microservices APIs.
• Identify excessive data exposure, insecure direct object references, JWT weaknesses.
• Assess API gateway implementations and security controls.
• Review API documentation and specifications.
• Perform static and dynamic security assessments of mobile applications.
• Analyze APK packages and mobile architecture; evaluate storage, cryptography, and backend integrations.
• Assess iOS security controls and runtime analysis; test jailbreak protections.
• Conduct IoT security assessments; evaluate firmware security and embedded OS.
• Produce high-quality technical and executive security assessment reports.
• Present findings to technical and business stakeholders; provide remediation recommendations.
• Track remediation progress and perform validation testing.

Skills

Red Team Operations

Threat Emulation

Penetration Testing

MITRE ATT&CK

Cyber Kill Chain

OWASP Top 10

OWASP API Security Top 10

Burp Suite Professional

Postman

JWT, OAuth2, OpenID Connect

MobSF

Frida

Objection

APKTool

JADX

Active Directory Security

Windows Security

Network Security

Wireless Security

Embedded Device Security

Firmware Analysis

Python

PowerShell

Bash

API Automation

Education

Bachelor's Degree in Cybersecurity

Tools

Burp Suite Professional

MobSF

Frida

Objection

APKTool

JADX

Postman

Job description

The Cybersecurity Offensive Security Specialist is responsible for conducting advanced security assessments, penetration testing, red team operations, and security reviews across web applications, APIs, mobile applications, networks, cloud environments, IoT devices, and Operational Technology (OT) systems. The role focuses on identifying vulnerabilities, validating security controls, simulating real-world cyberattacks, and providing actionable remediation recommendations to improve the organization's security posture.

Key Responsibilities

Red Teaming & Adversary Emulation

• Conduct advanced red team exercises simulating real-world threat actors.
• Execute attack scenarios aligned with MITRE ATT&CK framework.
• Perform phishing campaigns, credential attacks, social engineering simulations, and lateral movement exercises.
• Assess cyber defense effectiveness including SOC, SIEM, EDR
• Develop custom attack techniques and proof-of-concept exploits.
• Conduct Purple Team exercises with security monitoring teams.

Penetration Testing

External & Internal Infrastructure

• Perform black-box, gray-box, and white-box penetration testing.
• Assess internal and external network environments.
• Identify vulnerabilities in:
• Active Directory
• Windows and Linux systems
• Databases
• Validate remediation effectiveness through re-testing activities.

Web Application Security Assessments

• Conduct security assessments against web applications using OWASP Testing Methodology.
• Identify vulnerabilities including:
• Cross-Site Scripting (XSS)
• Session management weaknesses
• CSRF
• Access control issues
• Business logic flaws
• Perform manual exploitation and validation of findings.
• Review security architecture and secure coding controls.

API Security Assessments

• Conduct security testing of REST, SOAP, GraphQL, and Microservices APIs.
• Identify:
• Excessive Data Exposure
• Insecure Direct Object References
• JWT Security Weaknesses
• Assess API Gateway implementations and security controls.
• Review API documentation and specifications.

Mobile Application Security Assessments

• Perform static and dynamic security assessments.
• Analyze APK packages and mobile application architecture.
• Evaluate local storage security, cryptography implementation, and backend integrations.

iOS

• Assess iOS application security controls.
• Perform runtime security analysis.
• Test jailbreak protections and application hardening mechanisms.

Mobile Security Areas

• SSL Pinning bypass testing
• Data leakage assessments
• Secure storage validation
• Mobile API security testing

IoT Security Assessments

• Conduct security assessments of Internet of Things (IoT) devices.
• Evaluate:
• Device firmware security
• Wireless communication protocols
• Embedded operating systems
• Perform firmware extraction and analysis.
• Identify insecure configurations and exposed services.

Security Reporting & Stakeholder Engagement

• Produce high-quality technical and executive security assessment reports.
• Present findings to technical and business stakeholders.
• Provide practical remediation recommendations.
• Assist asset owners with vulnerability remediation planning.
• Track remediation progress and perform validation testing.

Required Technical Skills

Offensive Security

• Red Team Operations
• Threat Emulation
• Penetration Testing Methodologies
• MITRE ATT&CK
• Cyber Kill Chain

Web & API Security

• OWASP Top 10
• OWASP API Security Top 10
• Burp Suite Professional
• Postman
• JWT, OAuth2, OpenID Connect
• MobSF
• Frida
• Objection
• APKTool
• JADX

Infrastructure Security

• Active Directory Security
• Windows Security
• Network Security
• Wireless Security

IoT & OT Security

• Embedded Device Security
• Firmware Analysis

Scripting & Automation

• Python
• PowerShell
• Bash
• API Automation

Education

• Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field.

Experience

• 4+ years of hands-on penetration testing experience.