Offensive Security Consultant

Fatima Group; Lahore; On-site; PKR 2,000,000 - 5,000,000; Full time

Job summary

Osol is seeking an Offensive Security Consultant to build and lead high-end penetration testing and red team engagements for internal and external clients. You will stress-test cloud, AI/ML platforms, and OT/ICS environments, turning findings into actionable reports for engineers and executives.

The role is builder-level: set up toolchains, playbooks, and standards, mentor junior hires, and shape Osol's security posture through proactive testing and client-facing work.

Qualifications

• 5-7 years of offensive security experience in pen tests or red team.
• Client-facing consulting with enterprise clients.
• Strong report writing and stakeholder communication in English.

Responsibilities

• Execute web, network, cloud penetration tests and red teams for internal and external clients.
• Perform application security reviews: SAST/DAST and secure coding feedback.
• Extend testing into OT/ICS environments for manufacturing, energy and logistics.
• Lead AI/ML adversarial testing and cloud security assessments.
• Develop toolchains, playbooks, and reporting templates; mentor juniors.

Skills

Penetration testing

Cloud security testing

Client communication

Executive reporting

OT/ICS familiarity

Education

Master's in Cybersecurity

OSCP certification

Tools

Burp Suite

Metasploit

Cobalt Strike

Nmap

Wireshark

Job description

Job Description

We are looking for an Offensive Security Consultant to build Osol's offensive security practice from the ground up. The role owns the delivery of high-end penetration testing and red team engagements, both for Osol's own operations and for external enterprise and industrial clients. You will stress-test an advanced technology landscape: cloud infrastructure, AI/ML platforms, and IT/OT environments in sectors such as manufacturing and energy.

The ideal candidate is an experienced, certified penetration tester who has worked directly with clients and can turn technical findings into reports that both engineers and executives act on. While the immediate focus is offensive testing, the role also validates external defences and helps shape Osol's long-term security posture. This is a builder-level role: you will set up the toolchain, playbooks and standards, not only deliver engagements.

Key Responsibilities

Offensive Security Services (Internal and External)

• Execute web, network, mobile and cloud penetration tests and red team engagements for internal teams and for external enterprise and industrial clients.
• Perform application security reviews: secure code review and SAST/DAST, as part of engagement scope.
• Extend offensive testing into OT/ICS environments for internal and industrial clients in manufacturing, energy and logistics.
• Conduct adversarial testing of AI/ML systems, APIs and cloud environments.
• Support pre-sales by scoping, pricing and presenting offensive security engagements to prospective clients.
• Partner with internal engineering teams to remediate findings and harden systems.

Capability Development

• Select and stand up the core offensive security toolchain, such as Burp Suite, Metasploit, Cobalt Strike, Nmap and Wireshark.
• Build and standardise delivery playbooks, rules-of-engagement templates and reporting formats.
• Validate the detection coverage of platforms such as CrowdStrike and Palo Alto (EDR) and Wiz and Tenable (cloud security posture) during red team exercises.
• Define quality standards and reporting templates for all engagements.
• Represent Osol's technical capability in client-facing pitch and pre-sales calls.
• Contribute case studies and technical proof points for the company's market positioning.
• Mentor junior offensive security hires as the team grows.

Key Skills

• Hands-on fluency with penetration test tools such as Burp Suite, Metasploit, Cobalt Strike, Nmap and Wireshark.
• Hands-on experience testing at least one major cloud provider (AWS, Azure or GCP).
• Working knowledge of application security practices, including secure SDLC, SAST/DAST and API security. Familiarity with AI/LLM application testing, such as prompt injection and agentic systems.
• OSCP (OffSec Certified Professional) certification or equivalent practical certifications.
• Experience producing client-ready technical and executive reports. Experience scoping or selling security engagements.
• Exposure to offensive testing of OT/ICS environments in manufacturing, energy or logistics.
• Strong stakeholder communication in English, and comfort working with international clients.

Requirements

• Master's degree in Cybersecurity, Information Security, Computer Science, Information Technology or a related field.
• 5-7 years of relevant experience in offensive security (penetration testing and/or red teaming).
• Client-facing consulting experience, delivering security engagements to enterprise clients.