Pentest Engineer

TISS; Karachi Division; On-site; PKR 1,200,000 - 2,400,000; Full time

Job summary

Trillium Information Security Systems (TISS) in Karachi, Pakistan, invites a Senior Penetration Tester / Red Team Security Consultant with 1.5–2.5 years hands-on experience to join our security practice.

You will conduct VAPT across Web, Mobile, APIs, Networks, and AD, perform red team operations, document findings, and deliver remediation guidance while mentoring junior testers.

Qualifications

• 1.5–2.5 years of hands-on pentesting experience.

Responsibilities

• Conduct advanced VAPT assessments of Web, Mobile, APIs, Networks, and Active Directory environments.
• Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
• Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
• Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities.
• Perform SAST, DAST, and source code security reviews to identify security weaknesses.
• Prepare professional VAPT reports with PoCs , risk ratings, business impact, and remediation recommendations.
• Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers.
• Stay updated with emerging threats, exploitation techniques, and offensive security tools

Skills

Penetration testing

Red team operations

Web application testing

Mobile security testing

API security testing

VAPT reporting

OWASP Top 10

Communication skills

Education

Bachelor's degree in CS/Cybersecurity

CEH Practical

OSCP

GWAPT

Tools

Burp Suite

ZAP

MobSF

Frida

JADX

Checkmarx

Fortify

SonarQube

Kali Linux

ParrotOS

Job description

Trillium Information Security Systems (TISS) | Full time

Pentest Engineer

Karachi, Pakistan | Posted on 10/22/2026

Founded in 2005, Trillium Information Security Systems (TISS) is Pakistan’s first, and largest cybersecurity company. Today, Trillium has gained unrivaled expertise and experience; having delivered complex information assurance solutions to customers, performed specialized information security services, trained thousands of cyber security professionals across the country, and established a comprehensive network of resellers.

Job Description

Job Summary:

We are seeking a highly skilled and experienced Senior Penetration Tester / Red Team Security Consultant with 1.5 – 2.5 years of hands-on experience in conducting advanced penetration testing and security assessments across Web Applications, Mobile Applications (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.

The ideal candidate should possess strong technical expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting . The candidate must be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations .

Key Responsibilities:

• Conduct advanced VAPT assessments of Web, Mobile (Android, iOS & Huawei), APIs, Networks, and Active Directory environments.
  
• Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
  
• Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
  
• Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities.
  
• Perform SAST, DAST, and source code security reviews to identify security weaknesses.
  
• Prepare professional VAPT reports with PoCs , risk ratings, business impact, and remediation recommendations.
  
• Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers.
  
• Stay updated with emerging threats, exploitation techniques, and offensive security tools
  

Requirements

• 1.5–2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.
  
• Strong expertise in Web Application Penetration Testing, including OWASP Top 10, authentication/authorization testing, business logic vulnerabilities, and advanced exploitation techniques.
  
• Strong proficiency in API Penetration Testing, including REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.
  
• Practical experience in Active Directory Penetration Testing and Red Team Operations, including Kerberoasting , AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement.
  
• Proven experience testing Android and iOS applications for security flaws.
  
• Experience writing professional VAPT reports .
  
• Excellent communication skills , both written and verbal.
  
  

Preferred Tools & Technologies:

• Burp Suite, ZAP, MobSF , Frida, JADX, Checkmarx , Fortify, SonarQube
  
• Kali Linux, ParrotOS , or equivalent pentesting environments
  

Education & Certifications (Preferred but not mandatory):

• Bachelor's degree in Computer Science , Cybersecurity, or related field
  
• Certifications like eJPT , CEH Practical & Certified Application Security Engineer are preferred.
  
• Certifications such as OSCP, CEH, or GWAPT are a plus but not mandatory.