Infrastructure Penetration Tester

Sonata Software North America Inc.; San Jose (CA); Sur place; USD 140 000 - 170 000; Temps partiel

Résumé du poste

Sonata Software North America Inc. is seeking a Senior Infrastructure Penetration Tester to join our Offensive Security team in San Jose, CA.

The role demands hands-on testing across large-scale enterprise infrastructure, cloud environments, identity systems, and networks, with collaboration across engineering and security operations to reduce risk. The ideal candidate will have 6+ years of experience, strong AD/identity security knowledge, and the ability to present findings to technical and

Qualifications

• 6+ years of professional experience in penetration testing, offensive security, infrastructure security, or related cybersecurity disciplines.
• Strong hands-on experience conducting enterprise infrastructure penetration tests.
• Deep understanding of TCP/IP networking and common enterprise protocols.

Responsabilités

• Plan and execute internal and external infrastructure penetration tests across large enterprise environments.
• Assess Windows, Linux, Unix, network, virtualization, container, and hybrid infrastructure.
• Conduct network, host, service, and application-layer security testing.
• Identify vulnerabilities and demonstrate realistic attack paths and business impact.
• Perform authenticated and unauthenticated penetration testing.
• Conduct lateral movement, privilege escalation, credential-access, and persistence assessments within authorized environments.
• Evaluate segmentation and security controls between corporate, production, R&D, cloud, and restricted environments.
• Assess security of common enterprise services including DNS, DHCP, VPN, SSH, HTTP/S, LDAP, Kerberos, SMB, RDP, databases, proxies, and authentication infrastructure.

Connaissances

Offensive Security Mindset

Identity & Active Directory Security

Adversary Simulation

Automation & Tool Development

Risk-Based Thinking

Strong Technical Communication

Outils

Windows

macOS

Cloud platforms (AWS/GCP/Azure)

Containers/Docker/Kubernetes

Description du poste

Sonata Software, with over $1.2 Billion Revenue, is a leading AI-first Modernization Engineering company, powered by our unique PlatformationTM framework. Our 6400+ AI Engineers are helping enterprises transform from systems to intelligent business platforms leveraging partner ecosystem to drive speed, efficiency and growth. Our bouquet of Modernization Engineering Services with AI -first approach cuts across Cloud, Data, AI, Dynamics, Test Automation, and Managed Services.

Sonata’s AI-led modernization is enabled by a powerful suite of proprietary tools and assets. At the core is the Harmoni.AI Enterprise Platform, which includes Agent Bridge-a governance and observability framework; Agent Builder-a development toolkit for fungible agents integrated into enterprise systems; and the Agent Marketplace-an internal ecosystem for modular, reusable agents.

Headquartered in Bengaluru, India, Sonata Software has a strong global presence, including key regions US, UK, India, Malaysia, Mexico, Australia, DACH (Germany/Switzerland) & Nordics (Finland). We are a trusted partner of Fortune 500 companies in Banking, Financial Services and Insurance; Healthcare and Lifesciences; Telecom, Media, and Technology; and Retail, Manufacturing and Distribution space.

Job Title :Infrastructure Penetration tester

Experience: 8+ years

Job type :Contract

Location :San Jose CA(Onsite from Day 1)

Level: Senior Security Engineer / Senior Penetration Tester

Function: Cybersecurity / Offensive Security

About the Role

We are seeking an experienced Senior Infrastructure Penetration Tester to join our Offensive Security organization. The ideal candidate will have approximately 6+ years of hands‑on penetration testing experience in large-scale technology environments and a strong understanding of enterprise infrastructure, cloud platforms, identity systems, networks, and modern attack techniques.

In this role, you will conduct sophisticated security assessments across corporate infrastructure, cloud environments, data centers, production services, identity platforms, and internet-facing assets. You will work closely with infrastructure, cloud, engineering, security operations, and incident response teams to identify exploitable weaknesses and drive measurable risk reduction.

The successful candidate should be comfortable operating independently, developing attack paths, chaining vulnerabilities, and communicating technical findings to both engineers and senior leadership.

Key Responsibilities

• Plan and execute internal and external infrastructure penetration tests across large enterprise environments.
• Assess Windows, Linux, Unix, network, virtualization, container, and hybrid infrastructure.
• Conduct network, host, service, and application-layer security testing.
• Identify vulnerabilities and demonstrate realistic attack paths and business impact.
• Perform authenticated and unauthenticated penetration testing.
• Conduct lateral movement, privilege escalation, credential-access, and persistence assessments within authorized environments.
• Evaluate segmentation and security controls between corporate, production, R&D, cloud, and restricted environments.
• Assess security of common enterprise services including DNS, DHCP, VPN, SSH, HTTP/S, LDAP, Kerberos, SMB, RDP, databases, proxies, and authentication infrastructure.

Active Directory & Identity Security

• Perform penetration testing of Active Directory and enterprise identity environments.
• Assess Kerberos, NTLM, LDAP, Group Policy, trusts, privileged accounts, service accounts, and delegation configurations.
• Identify paths to domain administrator and other high-value privileges.
• Evaluate identity federation, SSO, MFA, privileged access management, and service identities.
• Assess identity attack paths across hybrid environments such as on-premises Active Directory and cloud identity providers.
• Conduct penetration testing across AWS, Azure, and/or GCP environments.
• Assess cloud IAM, roles, policies, storage, compute, networking, APIs, secrets, and management interfaces.
• Test cloud-to-corporate and cloud-to-production attack paths.
• Assess Kubernetes, containers, Docker, service meshes, and cloud-native infrastructure.
• Identify privilege‑escalation and lateral‑movement opportunities across cloud environments.
• Evaluate infrastructure‑as‑code and configuration risks where applicable.

External Attack Surface

• Perform continuous and point-in-time assessments of internet-facing infrastructure.
• Identify exposed services, misconfigurations, vulnerabilities, weak authentication, and attack paths.
• Conduct reconnaissance and attack‑surface analysis using both commercial and open‑source technologies.
• Validate findings from vulnerability scanners through manual exploitation and controlled testing.
• Assess perimeter security, WAFs, firewalls, VPNs, reverse proxies, CDN infrastructure, and other defensive controls.

Adversary Simulation

• Develop realistic attack scenarios based on current threat actor techniques.
• Chain multiple weaknesses to demonstrate realistic compromise scenarios.
• Collaborate with Red Team, Purple Team, Detection Engineering, and Security Operations teams.
• Develop proof-of-concept exploits and attack automation where appropriate.
• Validate preventive and detective security controls.

Automation & Tool Development

• Develop scripts and tooling to improve penetration-testing efficiency and scalability.
• Automate reconnaissance, vulnerability validation, attack-path discovery, evidence collection, and reporting.
• Integrate offensive-security tooling into enterprise security workflows.
• Leverage Python, PowerShell, Bash, and other scripting/programming languages.
• Evaluate and responsibly use AI-assisted security testing tools while maintaining human validation and authorization controls.
• Produce high-quality penetration-testing reports that clearly communicate:
• Business impact
• Affected assets
• Evidence
• Remediation recommendations
• Present findings to engineering teams, security leadership, and executive stakeholders.
• Work with infrastructure owners to validate remediation and perform retesting.
• Track recurring weaknesses and identify systemic security issues.
• Help establish security metrics such as remediation rates, exploitability, attack-path reduction, and risk exposure.

Required Qualifications

• 6+ years of professional experience in penetration testing, offensive security, infrastructure security, or closely related cybersecurity disciplines.
• Strong hands‑on experience conducting enterprise infrastructure penetration tests.
• Deep understanding of TCP/IP networking and common enterprise protocols.
• Strong Windows and Linux security knowledge.
• Demonstrated experience with Active Directory and enterprise identity systems.
• Experience with cloud security and at least one major cloud platform: AWS, Azure, or GCP.
• Experience identifying and exploiting common infrastructure vulnerabilities.
• Strong understanding of authentication, authorization, privilege escalation, lateral movement, and defense evasion concepts.
• Experience with vulnerability scanners and manual validation.
• Strong scripting skills in Python, PowerShell, Bash, or similar languages.
• Ability to independently scope, execute, document, and communicate penetration-testing engagements.
• Strong written and verbal communication skills.
• Ability to work effectively with infrastructure and engineering teams in a large technology organization.
• Demonstrated ability to operate within strict rules of engagement and responsible-disclosure requirements.

Preferred Qualifications

• Experience working in a large-scale Big Tech or hyperscale technology environment.
• Experience with Kubernetes, Docker, containers, service meshes, and cloud-native architectures.
• Experience testing CI/CD infrastructure, DevOps platforms, and infrastructure-as-code.
• Experience with security testing of APIs and microservices.
• Experience with red teaming or adversary simulation.
• Experience developing custom offensive-security tooling.
• Experience with attack-path analysis and identity-centric security assessments.
• Experience assessing zero-trust architectures.
• Experience with security testing of SaaS and internally developed enterprise platforms.
• Understanding of software supply-chain security and CI/CD attack paths.
• Experience working with bug bounty or vulnerability disclosure programs.
• Experience integrating penetration testing into enterprise security programs.

Technical Skills

Operating Systems

• Windows / Windows Server
• macOS

Networking

• TCP/IP
• DNS
• HTTP/S
• SSH
• VPN
• SMB
• RDP
• LDAP
• TLSFirewalls / WAF / Proxies

Identity

• Active Directory
• LDAP
• SAML
• OAuth/OIDC
• MFA
• PAM

Cloud

• AWS
• GCP
• IAM
• VPC/VNet
• Containers

Security Tools

Candidates should be able to understand and adapt tools rather than simply execute automated scanners.

Core Competencies

• Offensive Security Mindset
• Identity & Active Directory Security
• Adversary Simulation
• Automation & Tool Development
• Risk-Based Thinking
• Strong Technical Communication

Why join Sonata Software?

At Sonata, you´ll have an outstanding opportunity. The chance to use your skills and imagination to push the boundaries of what´s possible. To build never seen before solutions to some of the world’s toughest problems. You´ll be challenged, but you will not be alone. You´ll be joining a team of diverse innovators, all driven to go beyond the status quo to craft what comes next.

Sonata Software is an Equal Opportunity Employer encouraging diversity in the workplace. All qualified applicants will receive consideration for employment without regard to race, national origin, gender identity, age, religion, disability, sexual orientation, veteran status, marital status, or any other characteristics protected by law.