Senior Offensive Security Engineer: Azure & Entra ID (Contract)

Applaudo Studios; Ciudad de México; On-site; MXN 1,000,000 - 1,500,000; Part time

Job summary

Applaudo Studios seeks a Senior Offensive Security Engineer to perform identity and Azure boundary breach testing across two Azure tenants. You will start from approved footholds, escalate privileges through Entra ID, Azure RBAC, and managed identities, and probe cross-tenant separation controls.

You will document attack paths end-to-end, with precise, timestamped evidence, while maintaining fully reversible actions and no production disruption.

Qualifications

• Bachelor’s degree or equivalent professional experience.
• End-to-end penetration testing methodology including recon, exploit, privilege escalation, lateral movement, reporting.
• Offensive testing of Microsoft Entra ID, directory roles, PIM, app registrations, consent grants, CA behavior.
• Azure RBAC privilege escalation and managed identities/service principals abuse.
• Token theft and abuse: tokens, IMDS endpoint, Graph/ARM APIs.
• Hands-on Azure offensive tooling: ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst/GraphRunner.
• Attack-path analysis across subscriptions/tenants, including B2B guests and Azure Lighthouse.
• Active Directory and Windows privilege escalation and lateral movement.
• Know-how of Microsoft Cloud Penetration Testing Rules of Engagement.
• CVSS v3.1 scoring and regulator-ready reporting with reproducible evidence.
• Operate in controlled, reversible production testing.

Responsibilities

• Lead identity and Azure boundary breach testing across two Azure tenants.
• Start from approved footholds and attempt escalation through Entra ID, RBAC, identities, or principals.
• Test movement between subscriptions and tenants; evaluate separation controls.
• Attempt to access secrets and tokens in Key Vault, Storage, and databases.
• Assess AKS workloads and workload identity abuse.
• Link cloud findings to application-layer findings for end-to-end paths.
• Ensure only harmless reads or approved reversible actions; avoid tenant-wide changes.
• Document outcomes with evidence; report posture observations separately.
• Remove artifacts after testing; ensure clean state.
• Retest remediated paths and contribute to revalidation.
• Escalate stop conditions within one hour; avoid disruption.

Skills

Azure Entra ID & Azure RBAC

Offensive security testing

Cloud security

Penetration testing

Security reporting

English communication

Education

Bachelor’s degree in CS/Cybersecurity/Software Engineering or related field

Tools

ROADtools

AzureHound/BloodHound

AADInternals

MicroBurst/GraphRunner

Job description

Applaudo Studios seeks a Senior Offensive Security Engineer to perform identity and Azure boundary breach testing across two Azure tenants. You will start from approved footholds, escalate privileges through Entra ID, Azure RBAC, and managed identities, and probe cross-tenant separation controls.

You will document attack paths end-to-end, with precise, timestamped evidence, while maintaining fully reversible actions and no production disruption.