Red Team Engineer

MTBC, Inc.; Bagh; On-site; PKR 2,000,000 - 2,800,000; Full time

Job summary

MTBC, Inc. in Bagh, AJK is seeking a Red Team Engineer to proactively identify vulnerabilities and simulate real-world attacks to strengthen security controls and resilience.

You will conduct advanced testing across networks, apps, and cloud, develop custom tools, and collaborate with the Blue Team to enhance detection and response capabilities. The role requires 3+ years of pentesting/red team experience, a relevant Bachelor’s degree, and strong knowledge of Windows/Linux, AD, and cloud

Qualifications

• Bachelor's degree required in a related field.
• Minimum 3 years of hands-on pentesting/red team.
• Experience with Windows/Linux, AD, cloud environments.
• Familiarity with attack frameworks.

Responsibilities

• Conduct advanced penetration testing on networks, applications, APIs, and cloud environments.
• Perform red teaming exercises simulating real-world cyberattacks and adversary behaviors.
• Identify, exploit, and validate vulnerabilities in internal and external systems.
• Develop and execute attack scenarios to evaluate detection and response capabilities.
• Bypass security controls such as EDR, SIEM, WAF, and IAM systems.
• Research and test latest vulnerabilities (CVE-based threats) relevant to the organization.
• Perform post-exploitation activities including privilege escalation, lateral movement, and persistence.
• Collaborate with Blue Team / SOC to improve threat detection and incident response.
• Prepare detailed technical reports outlining findings, risk impact, and remediation recommendations.
• Develop custom scripts, payloads, and tools for offensive security testing.
• Continuously assess and improve the organization’s security posture.
• Stay updated with emerging threats, tools, and adversary tactics (TTPs).

Skills

Penetration testing

Red team operations

Adversary emulation

Scripting

Windows/Linux administration

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Metasploit

Burp Suite

Cobalt Strike

Nmap

BloodHound

Job description

Department: Information Security Experience: 3 Years Deadline: October 31, 2026 Location: Bagh, AJK

Job Profile

Job Purpose:

The Red Team Engineer is responsible for proactively identifying and exploiting security vulnerabilities across the organization’s networks, applications, and infrastructure. This role simulates real-world cyberattack scenarios to assess the effectiveness of existing security controls and enhance the organization’s overall security posture and resilience against emerging threats.

Key Responsibilities:

• Conduct advanced penetration testing on networks, applications, APIs, and cloud environments
• Perform red teaming exercises simulating real-world cyberattacks and adversary behaviors
• Identify, exploit, and validate vulnerabilities in internal and external systems
• Develop and execute attack scenarios to evaluate detection and response capabilities
• Bypass security controls such as EDR, SIEM, WAF, and IAM systems
• Research and test latest vulnerabilities (CVE-based threats) relevant to the organization
• Perform post-exploitation activities including privilege escalation, lateral movement, and persistence
• Conduct social engineering assessments (phishing, vishing, etc.) where permitted
• Collaborate with Blue Team / SOC to improve threat detection and incident response
• Prepare detailed technical reports outlining findings, risk impact, and remediation recommendations
• Develop custom scripts, payloads, and tools for offensive security testing
• Continuously assess and improve the organization’s security posture
• Stay updated with emerging threats, tools, and adversary tactics (TTPs)

Tools / Skills

Required Qualifications:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field
• Minimum 3 years of hands‑on experience in penetration testing or red team operations
• Strong knowledge of Windows, Linux, Active Directory, cloud environments, and enterprise networks.
• Experience with attack frameworks and adversary emulation.

Preferred Qualifications

• OSEP
• OSCP
• CRTO
• GXPN

Skills Required

• Strong understanding of network protocols and operating systems (Windows/Linux)
• Experience with cloud platforms such as Azure and AWS
• Proficiency in security testing tools (e.g., Metasploit, Burp Suite, Cobalt Strike, Nmap, BloodHound)
• Knowledge of MITRE ATT&CK framework and adversary simulation techniques
• Experience in web application and API security (OWASP Top 10)
• Understanding of Active Directory attacks and post-exploitation techniques
• Familiarity with endpoint security controls and evasion techniques
• Proficiency in scripting/programming (Python, PowerShell, Bash)