Penetration Testing/ Red Team - Must Need OSCP Certified

Zoho; New York (NY); On-site; USD 140,000 - 190,000; Full time

Job summary

Zoho is seeking a Senior Penetration Tester / Red Team Engineer in New York to lead offensive security initiatives, build custom tools, and conduct comprehensive assessments across web, API, cloud, and enterprise environments.

The role emphasizes hands-on security engineering, adherence to industry methodologies, and collaboration with security and development teams to improve overall security posture.

Qualifications

• 3–5 years of experience in Penetration Testing, Red Teaming, Security Engineering, or Software Development with a strong security focus.
• Strong programming and scripting expertise in languages such as Python, Go, Java, C#, PowerShell, or similar technologies.
• Hands-on experience conducting penetration testing using industry-standard methodologies and frameworks.
• Experience participating in red team engagements and adversary simulation exercises.
• Proficiency with offensive security tools such as Burp Suite, Metasploit, Nmap, Cobalt Strike, BloodHound, or similar platforms.
• Strong understanding of web application security, API security, network security, and cloud security concepts.
• Experience developing custom security tools, automation scripts, or offensive security utilities.
• Familiarity with security frameworks such as MITRE ATT&CK, OWASP Top 10, and penetration testing best practices.
• Excellent analytical, troubleshooting, documentation, and communication skills.
• Security certifications such as OSCP, CRTO, PNPT, GPEN, CEH, or equivalent are highly desirable.

Responsibilities

• Design and develop custom security tools, automation frameworks, and scripts to support penetration testing and red team operations.
• Conduct comprehensive penetration testing of web applications, APIs, cloud platforms, networks, and enterprise infrastructure.
• Participate in red team engagements that emulate real-world adversaries to evaluate organizational security defenses.
• Identify, validate, and document vulnerabilities, attack paths, and security weaknesses with actionable remediation recommendations.
• Build integrations between security tools, enterprise platforms, and automation workflows to improve testing efficiency and coverage.
• Research and develop offensive security techniques, attack simulations, and proof-of-concept exploits for emerging threats.
• Support security engineering initiatives by solving complex technical challenges requiring both development and cybersecurity expertise.
• Collaborate with development, infrastructure, and security teams to improve security posture and address identified risks.
• Maintain detailed documentation of testing methodologies, findings, tools, and operational procedures.
• Contribute to continuous improvement of penetration testing, red teaming, and security automation capabilities across the organization.

Skills

Python

Go

Java

C#

PowerShell

Tools

Burp Suite

Metasploit

Nmap

Cobalt Strike

BloodHound

Job description

We are seeking a Senior Penetration Tester / Red Team Engineer to support offensive security initiatives through advanced penetration testing, red team operations, and custom security tool development. This role combines hands-on security engineering with offensive security expertise to identify vulnerabilities, simulate real-world attack scenarios, and develop automation solutions that enhance security assessment capabilities. The ideal candidate will possess strong software development skills, a deep understanding of security testing methodologies, and experience conducting enterprise security assessments.

*Please note, this role is not able to offer visa transfer or sponsorship now or in the future*

In this role, you will:

• Design and develop custom security tools, automation frameworks, and scripts to support penetration testing and red team operations.
• Conduct comprehensive penetration testing of web applications, APIs, cloud platforms, networks, and enterprise infrastructure.
• Participate in red team engagements that emulate real-world adversaries to evaluate organizational security defenses.
• Identify, validate, and document vulnerabilities, attack paths, and security weaknesses with actionable remediation recommendations.
• Build integrations between security tools, enterprise platforms, and automation workflows to improve testing efficiency and coverage.
• Research and develop offensive security techniques, attack simulations, and proof-of-concept exploits for emerging threats.
• Support security engineering initiatives by solving complex technical challenges requiring both development and cybersecurity expertise.
• Collaborate with development, infrastructure, and security teams to improve security posture and address identified risks.
• Maintain detailed documentation of testing methodologies, findings, tools, and operational procedures.
• Contribute to continuous improvement of penetration testing, red teaming, and security automation capabilities across the organization.

What you need to have to be considered

• 3–5 years of experience in Penetration Testing, Red Teaming, Security Engineering, or Software Development with a strong security focus.
• Strong programming and scripting expertise in languages such as Python, Go, Java, C#, PowerShell, or similar technologies.
• Hands‑on experience conducting penetration testing using industry-standard methodologies and frameworks.
• Experience participating in red team engagements and adversary simulation exercises.
• Proficiency with offensive security tools such as Burp Suite, Metasploit, Nmap, Cobalt Strike, BloodHound, or similar platforms.
• Strong understanding of web application security, API security, network security, and cloud security concepts.
• Experience developing custom security tools, automation scripts, or offensive security utilities.
• Familiarity with security frameworks such as MITRE ATT&CK, OWASP Top 10, and penetration testing best practices.
• Excellent analytical, troubleshooting, documentation, and communication skills.
• Security certifications such as OSCP, CRTO, PNPT, GPEN, CEH, or equivalent are highly desirable.