Cloud Penetration Tester (AWS/Azure/GCP) - Remote

Embedded Shishya; United States; Remote; USD 110,000 - 220,000; Part time

Job summary

Invadel, a New York City-based penetration testing firm, seeks a contract security tester for fixed-scope engagements across the United States, compensated per engagement. Engagements run five to ten testing days plus a retest, performed within each provider’s penetration testing policy.

You will review IAM policies, roles and trust, storage exposure, compute and container configurations, network controls and secrets handling, attempting privilege escalation from an assumed-breach position and

Qualifications

• four or more years of cloud security work with hands-on offensive testing on at least two of AWS, Azure and GCP.
• working fluency with infrastructure as code, containers and Kubernetes.
• based in the United States with authorization to work here.
• reports written for engineers and auditors, with a redacted sample report as part of the application.
• two professional references

Responsibilities

• review IAM policies, roles and trust relationships, storage exposure, compute and container configuration, network controls, secrets handling and logging against the CIS foundations benchmark
• attempt privilege escalation and data access from an assumed-breach position and document the attack path and blast radius
• record whether the client’s detection would have caught each step
• write the report with CVSS-scored findings, prioritized remediation and compliance mapping, then retest
• leave nothing persistent behind

Skills

Cloud security

Offensive testing

Technical report writing

Tools

AWS

Azure

GCP

Kubernetes

Containers

Job description

Invadel, a New York City-based penetration testing firm, seeks a contract security tester for fixed-scope engagements across the United States, compensated per engagement. Engagements run five to ten testing days plus a retest, performed within each provider’s penetration testing policy.

You will review IAM policies, roles and trust, storage exposure, compute and container configurations, network controls and secrets handling, attempting privilege escalation from an assumed-breach position and