استخدام vapt & red team lead

توضیحات آگهی

Job Overview
The VAPT and Red Team Lead leads an engineering driven Offensive Security team covering vulnerability assessment penetration testing adversary simulation DevSecOps and AI security The team identifies exploitable weaknesses validates business impact and supports secure product delivery
This role combines hands on technical leadership with team development and ownership of the offensive security roadmap Working with SOC Development DevOps Cloud Infrastructure and Product teams the lead ensures high quality assessments effective remediation and measurable reduction of exploitable risks
RESPONSIBILITIES
Define and execute the offensive security strategy operating model and capability roadmap prioritize work based on business risk and team capacity
Lead and develop offensive security engineers assign engagements review technical decisions and deliverables and coach team members
Lead vulnerability assessments and black box grey box and white box penetration tests across applications APIs internal services networks Active Directory and cloud environments
Plan and lead red team engagements with clear objectives scope rules of engagement and safeguards emulate adversary TTPs to validate attack paths and demonstrate business impact
Oversee attack surface monitoring and vulnerability triage validate exploitability attack chains and business impact and track remediation through retesting
Embed threat modeling secure code review and SAST DAST SCA secret and container scanning into the SDLC and CI CD pipelines with engineering teams
Lead AI LLM security assessments covering prompt injection sensitive data exposure unsafe tool use and excessive agent permissions
Improve assessment methods security tooling and automation using scripts APIs and AI assisted workflows with appropriate human review
Set reporting and evidence standards deliver reproducible findings and practical remediation guidance and coordinate resolution of critical risks before release
Track assessment coverage delivery quality remediation time and recurring weaknesses communicate risks capability gaps and improvement priorities to management
Requirements
7 years of cybersecurity experience including at least 5 years in penetration testing application security or offensive security
Proven experience leading security engineers and technical initiatives developing team capabilities and managing assessment priorities and stakeholders
Deep hands on knowledge of web and API security including authentication authorization business logic vulnerability chaining and exploit validation
Practical experience assessing IT products such as Web Applications Mobile Applications Desktop Applications Network Services and conducting source code security reviews
Strong knowledge of Windows Linux Active Directory network protocols and cloud attack paths familiarity with Docker and Kubernetes security
Experience with adversary simulation MITRE ATT CK and red team tools and techniques ability to design realistic attack scenarios and validate paths to critical assets
Practical experience with threat modeling to identify trust boundaries map attack paths and prioritize security testing knowledge of OWASP Top 10 API Security Top 10 WSTG and ASVS
Experience with DevSecOps GitLab or equivalent CI CD platforms and integrating and tuning application dependency secret and container security tools
Proficiency with Burp Suite and vulnerability assessment tools scripting and security automation skills in Python PowerShell Bash Go or similar languages
Working knowledge of AI LLM application risks and security testing including prompt injection data leakage and agent tool access controls
Strong leadership systems thinking technical decision making and reporting skills ability to explain risks and agree remediation priorities across teams
Certifications such as OSCP OSWE OSEP BSCP or CRTO or equivalent practical qualifications are preferred but not mandatory
شرکت دیجی کالا Digikala
دسته بندی IT DevOps Server
نحوه همکاری تمام وقت
نوع همکاری حضوری
مدرک تحصیلی کارشناسی
سابقه کار بیش از شش سال
حقوق توافقی
جنسیت مهم نیست
مهارت ها DevSecOps CI CD
شهر تهران تهران