Senior Offensive Security Engineer (Azure & Entra ID)

About You

You are an offensive security professional with hands-on expertise in Microsoft Entra ID, Azure privilege escalation, and identity-driven attack paths. You can start from an approved foothold, assess security boundaries, and demonstrate whether controls prevent access to privileged identities and sensitive resources.

You approach production testing carefully, keeping actions controlled, reversible, and precisely documented. You can explain complex attack paths to cloud administrators and security stakeholders and distinguish demonstrated exploitation from posture-only observations.

Note: This role operates under a contractor model for an initial period of 2 months , with the possibility of extension.

Responsibilities

Lead identity and Azure boundary assumed breach testing across two Azure tenants.; Start from approved footholds, including a standard user with MFA, a workload identity credential or a shell on Azure compute, and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities and service principals.; Attempt movement between approved subscriptions and between tenants, and assess whether separation controls hold.; Attempt to reach secrets, keys, tokens and stores of nonpublic information in Key Vault, Storage and databases.; Assess AKS workloads where authorized, including workload identity abuse and pod to node escalation.; Chain cloud findings with application layer findings, for example moving from a compromised application to its workload identity, to demonstrate end to end attack paths.; Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant wide settings.; Report each objective as achieved, with the attack path and supporting evidence, or blocked, with what stopped the attempt, and report posture only observations separately as untested.; Remove all created artifacts, including app registrations, role assignments and credentials, before testing ends.; Retest remediated attack paths and contribute to the revalidation report.; Escalate stop conditions within one hour and execute all testing without service disruption or data loss.

Requirements

Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.; End to end penetration testing methodology covering reconnaissance, exploitation, privilege escalation, lateral movement and reporting.; Offensive testing of Microsoft Entra ID, including directory roles, PIM, app registrations, consent grants and Conditional Access behavior.; Azure RBAC privilege escalation and abuse of managed identities and service principals.; Token theft and abuse, covering access and refresh tokens, the IMDS managed identity endpoint, and the Graph and ARM APIs.; Hands on experience with Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.; Attack path analysis across subscriptions and tenants, including B2B guests, multitenant apps and Azure Lighthouse.; Active Directory and Windows privilege escalation and lateral movement.; Working knowledge of the Microsoft Cloud Penetration Testing Rules of Engagement.; CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.; Ability to operate in a controlled and reversible way in production cloud environments.; Precise, timestamped record keeping of every action to support detection and response review.; Strong spoken and written English (B2+) to explain attack paths live to client cloud administrators and managed service providers.; Proven end to end offensive security experience across reconnaissance, exploitation, privilege escalation, lateral movement and reporting.; Offensive testing of Microsoft Entra ID and Azure RBAC , including managed identities and service principals.; Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.; Cross subscription and cross tenant attack path analysis , plus Active Directory privilege escalation and lateral movement.

Nice to have

Kubernetes and AKS offensive testing, including container escape, kubelet abuse and workload identity.; Hybrid identity attack paths across Entra Connect, ADFS and on premises Active Directory to cloud.; Web application and API penetration testing following OWASP WSTG and the OWASP API Security Top 10.; Ability to read Defender for Cloud or CSPM output to plan attack paths.; Certifications such as CARTP, CARTE, GIAC Cloud Penetration Tester (GCPN), OSCP, OSEP, CRTP or CRTE.