Senior Offensive Security Engineer – Azure, Entra ID

This is a fully remote position, open to applicants in Indonesia, +1 more country.

📋 Description

• Oversee identity and Azure boundary assumed-breach testing across two distinct Azure tenants

• Initiate from sanctioned footholds and strive for privilege escalation via Entra ID roles, Azure RBAC, managed identities, and service principals

• Attempt to navigate between authorized subscriptions and tenants while evaluating separation controls

• Seek access to secrets, keys, tokens, and confidential information within Key Vault, Storage, and databases

• Evaluate sanctioned AKS workloads, focusing on workload identity exploitation and pod-to-node escalation

• Link cloud findings with application-layer findings to illustrate comprehensive attack paths

• Demonstrate privileged access through non-intrusive read actions or approved reversible markers without altering tenant-wide configurations

• Report objectives as accomplished or obstructed, detailing attack paths and supporting evidence; categorize posture-only observations as untested

• Eliminate created artifacts, including app registrations, role assignments, and credentials, prior to the conclusion of testing

• Reassess remediated attack paths and contribute to the revalidation documentation

• Communicate stop conditions within one hour and carry out testing without disrupting services or compromising data

• Articulate complex attack paths to client cloud administrators and managed service providers

⛳️ Requirements

• A Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related discipline is preferred, or equivalent professional experience

• Comprehensive end-to-end penetration testing methodology encompassing reconnaissance, exploitation, privilege escalation, lateral movement, and reporting

• Proficient in offensive testing of Microsoft Entra ID, including directory roles, PIM, app registrations, consent grants, and Conditional Access behaviors

• Expertise in Azure RBAC privilege escalation and exploitation of managed identities and service principals

• Experience with token theft and misuse involving access and refresh tokens, the IMDS managed identity endpoint, as well as Graph and ARM APIs

• Practical knowledge of ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst, or GraphRunner

• Conduct attack path analysis across subscriptions and tenants, including B2B guests, multitenant applications, and Azure Lighthouse

• Knowledge of Active Directory and Windows privilege escalation and lateral movement techniques

• Familiarity with the Microsoft Cloud Penetration Testing Rules of Engagement

• CVSS v3.1 scoring and regulator-ready reporting backed by reproducible evidence

• Capability to operate in a controlled and reversible manner in production cloud environments

• Accurate, timestamped documentation of every action taken

• Proficient spoken and written English (B2+)

• Familiarity with Kubernetes and AKS offensive testing, hybrid identity attack paths, web application and API penetration testing, Defender for Cloud/CSPM output, and relevant certifications are advantageous

🏝️ Benefits

• Contract engagement for an initial duration of 2 months, with the potential for extension

• Remote work opportunity