Pentest Engineer

Trilliuminfosec; Karachi Division; On-site; PKR 1,200,000 - 2,400,000; Full time

Job summary

Trillium Information Security Systems (TISS) in Karachi, Pakistan is seeking a Senior Penetration Tester / Red Team Security Consultant with 1.5–2.5 years of hands-on experience. You will conduct penetration testing across Web Applications, Mobile platforms (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.

The ideal candidate will possess expertise in manual testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security

Qualifications

• 1.5–2.5 years hands-on experience in penetration testing and offensive security operations.
• Strong Web App pentesting skills including OWASP Top 10 and vulnerabilities in authentication/authorization.
• Experience with API security testing, AD pentesting, and red team activities.

Responsibilities

• Conduct advanced VAPT assessments of Web, Mobile, APIs, Networks and Active Directory environments.
• Execute Red Team operations including AD exploitation, lateral movement and post-exploitation.

Skills

Web app pentesting

API pentesting

Active Directory pentesting

Red team operations

Mobile app security testing

Education

Bachelor's degree in CS/Cybersecurity

Tools

Burp Suite

ZAP

MobSF

Frida

JADX

Checkmarx

Fortify

SonarQube

Kali Linux

ParrotOS

Job description

Trillium Information Security Systems (TISS) | Full time

Pentest Engineer

Karachi, Pakistan | Posted on 10/22/2026

Founded in 2005, Trillium Information Security Systems (TISS) is Pakistan’s first, and largest cybersecurity company. Today, Trillium has gained unrivaled expertise and experience; having delivered complex information assurance solutions to customers, performed specialized information security services, trained thousands of cyber security professionals across the country, and established a comprehensive network of resellers.

Job Description

Job Summary:

We are seeking a highly skilled and experienced Senior Penetration Tester / Red Team Security Consultant with 1.5 – 2.5 years of hands-on experience in conducting advanced penetration testing and security assessments across Web Applications, Mobile Applications (Android, iOS & Huawei), APIs, Network Infrastructure, and Active Directory environments.

The ideal candidate should possess strong technical expertise in manual penetration testing, vulnerability exploitation, red team operations, SAST/DAST methodologies, and security reporting . The candidate must be capable of independently managing security assessments, identifying complex vulnerabilities, demonstrating their business impact, and providing effective remediation recommendations .

Key Responsibilities:

• Conduct advanced VAPT assessments of Web, Mobile (Android, iOS & Huawei), APIs, Networks, and Active Directory environments.
  
• Execute Red Team operations, including Active Directory exploitation, lateral movement, post-exploitation, and adversary simulation.
  
• Perform Mobile Application Security Testing, including reverse engineering, runtime manipulation, SSL pinning bypass, and root/jailbreak detection bypass.
  
• Conduct API Security Testing, focusing on authentication, authorization, token security, and business logic vulnerabilities.
  
• Perform SAST, DAST, and source code security reviews to identify security weaknesses.
  
• Prepare professional VAPT reports with PoCs , risk ratings, business impact, and remediation recommendations.
  
• Communicate findings to clients, conduct vulnerability revalidation, and guide junior penetration testers.
  
• Stay updated with emerging threats, exploitation techniques, and offensive security tools
  

Requirements

• 1.5–2.5 years of practical experience in penetration testing, vulnerability assessments, and offensive security operations.
  
• Strong expertise in Web Application Penetration Testing, including OWASP Top 10, authentication/authorization testing, business logic vulnerabilities, and advanced exploitation techniques.
  
• Strong proficiency in API Penetration Testing, including REST/SOAP APIs, JWT security, OAuth 2.0, broken object-level authorization (BOLA), and business logic exploitation.
  
• Practical experience in Active Directory Penetration Testing and Red Team Operations, including Kerberoasting , AS-REP Roasting, ACL abuse, privilege escalation, credential attacks, and lateral movement.
  
• Proven experience testing Android and iOS applications for security flaws.
  
• Experience writing professional VAPT reports .
  
• Excellent communication skills , both written and verbal.
  
  

Preferred Tools & Technologies:

• Burp Suite, ZAP, MobSF , Frida, JADX, Checkmarx , Fortify, SonarQube
  
• Kali Linux, ParrotOS , or equivalent pentesting environments
  

Education & Certifications (Preferred but not mandatory):

• Bachelor's degree in Computer Science , Cybersecurity, or related field
  
• Certifications like eJPT , CEH Practical & Certified Application Security Engineer are preferred.
  
• Certifications such as OSCP, CEH, or GWAPT are a plus but not mandatory.