Cloud Penetration Tester (AWS, Azure, GCP), Contract

Invadel; United States; Remote; Full time

Job summary

Invadel is a New York City penetration testing firm delivering fixed-scope, fixed-price engagements with public pricing and a free retest. This contract role is remote within the United States, paid per engagement.

Engagements run five to ten testing days plus a retest and are conducted under each provider's penetration testing policy. The candidate will review IAM policies, perform offensive testing across cloud platforms, document attack paths, and deliver CVSS-scored findings with remediation

Qualifications

• Four or more years of cloud security work with hands-on offensive testing on at least two of AWS, Azure and GCP.
• Working fluency with infrastructure as code, containers and Kubernetes.
• Based in the United States with authorization to work here.
• Reports written for engineers and auditors, with a redacted sample report as part of the application.
• Two professional references.

Responsibilities

• Review IAM policies, roles and trust relationships, storage exposure, compute and container configuration, network controls, secrets handling and logging against the CIS foundations benchmark.
• Attempt privilege escalation and data access from an assumed-breach position and document the attack path and blast radius.
• Record whether the client's detection would have caught each step.
• Write the report with CVSS-scored findings, prioritized remediation and compliance mapping, then retest.
• Leave nothing persistent behind.

Skills

Cloud security

Offensive security testing

AWS

Azure

GCP

Kubernetes

Containers

Infrastructure as Code

Tools

Terraform

Docker

CI/CD tooling

Job description

Invadel is a New York City penetration testing firm. Every engagement is fixed-scope and fixed-price, agreed in writing, with public prices at invadel.com/pricing and a free retest. This is a contract role, remote within the United States, paid per engagement; engagements run five to ten testing days plus a retest and are performed within each provider's penetration testing policy.

What you will do:

• review IAM policies, roles and trust relationships, storage exposure, compute and container configuration, network controls, secrets handling and logging against the CIS foundations benchmark;
• attempt privilege escalation and data access from an assumed-breach position and document the attack path and blast radius;
• record whether the client's detection would have caught each step;
• write the report with CVSS-scored findings, prioritized remediation and compliance mapping, then retest;
• leave nothing persistent behind.

What we need:

• four or more years of cloud security work with hands-on offensive testing on at least two of AWS, Azure and GCP;
• working fluency with infrastructure as code, containers and Kubernetes;
• based in the United States with authorization to work here;
• reports written for engineers and auditors, with a redacted sample report as part of the application;
• two professional references.

Nice to have:

• internal network and Active Directory testing;
• experience producing evidence for SOC 2, PCI DSS or HIPAA audits.