Red Team Security Consultant

(Junior to Senior - broad experience band) Are you interested in automating the build and deployment process of the application while ensuring application security? If yes, then Payatu is the place for you. We are always in search of passionate people to expand our renowned Bandit family at Payatu. In the quest for Bandits, here is an excellent opportunity we would like to share with you. Who we are Payatu is a GPTW certified company where we strive to create a culture of excellence, growth and innovation that empowers our employees to reach new heights in their careers. We are young and passionate folks driven by the power of the latest and innovative technologies in IoT, AI/ML, Blockchain, and many other advanced technologies. We are on the mission of making the Cyberworld safe for every organization, product, and individual. What we look for outside work parameters: Your expertise is your primary qualification, not your degree or certification. Your publicly known contributions are your credentials. Papers you have written, tools you have developed are your references. Your write-up reflects your interests and ethics. Your published exploits, CTF rankings, and Hall of Fame listings are testimonies of your work. Original tools or scripts you've open-sourced count in your favor. Your research paper was published and/or presented at a conference. You are learning from the community and enthusiastically contributing back. You are a perfect technical fit if Strong fundamentals of application, network, and Windows/Active Directory protocols. Design and execute advanced penetration testing, vulnerability assessments, and simulated attack scenarios (Red Team, Purple Team) to identify security weaknesses across an organization's systems, networks, cloud, and applications. Utilize a variety of tools and techniques to develop and implement sophisticated attack strategies, mimicking the tactics, techniques, and procedures used by real-world adversaries. Collaborate with the Blue Team to test and enhance incident response capabilities through Red vs.Blue exercises and Purple Team workshops, identifying gaps and recommending detection/mitigation improvements. Document and communicate detailed findings - vulnerabilities, exploit chains, and remediation guidance - in clear, actionable reports for technical and executive stakeholders. Stay current with emerging threats and attack vectors; develop or customize tools, scripts, and techniques to enhance Red Team capabilities. Strong planning and execution of social engineering attacks - phishing, vishing, pretexting, baiting, and tailgating - to assess human vulnerabilities and insider-threat risk. Solid grounding in web application security with hands-on pen testing experience, preferably including regulated or financial-domain applications. Good command of at least one programming/scripting language for tooling and automation. Should be able to suggest optimum security improvements to application and infrastructure components. You Have All Our Desired Qualities, if Hands-on Active Directory exploitation and lateral movement experience, including credential attacks, privilege escalation, and abuse of trust relationships. Comfortable with attack-path mapping tools and holds a recognized AD-focused certification. Offensive experience across major cloud and identity platforms, including privilege escalation, token/credential abuse, and misconfiguration exploitation. Ability to assess cloud landing zones and enterprise perimeter/identity infrastructure end-to-end. Named, hands-on experience with command-and-control frameworks - not just conceptual familiarity. Practical defense-evasion skills against modern endpoint protection and detection controls. Understanding of C2 infrastructure design and operational security practices. Experience threat-modeling and adversarial testing AI/LLM-powered applications and agentic systems. Exposure to building or red-teaming AI-augmented offensive tooling or automation pipelines. Deep web and API security expertise, including chained and business-logic vulnerabilities. Track record of vulnerability discovery and/or public bug bounty program participation. Comfortable with large-scale reconnaissance, source/asset analysis, and secrets exposure hunting. Experience running or supporting Purple Team exercises that translate red findings into detection improvements. Threat hunting fundamentals, including log telemetry analysis and familiarity with detection/monitoring platforms. Security assessment experience with CI/CD pipelines and build/release infrastructure. Container and orchestration security experience. You like automating stuff and writing your own tools to scale assessments. Experience with distributed or large-scale scanning infrastructure is a strong plus. Excellent written and verbal communication; able to translate technical impact into business/compliance language for non-technical stakeholders. Comfortable quantifying impact rather than describing findings only qualitatively. Can work independently and within a team, meet deadlines in a dynamic, fast-paced environment, and is self-driven, proactive, and hardworking. Actively working on something in the field outside of official work. Your everyday work will look like Security assessment of web applications, APIs, networks, Active Directory, and cloud environments across various platforms. Design and execution of full-scope red team engagements - initial access through internal compromise to objective completion. Back your findings with working proof-of-concept exploits and reproducible attack chains. Collect evidence and maintain a detailed write-up of findings, mapped to relevant industry frameworks. Understand and explain results in terms of business and compliance impact. Explain and demonstrate vulnerabilities to application/system owners; run purple-team sessions with Blue Team counterparts. Provide appropriate remediation and mitigation guidance for identified vulnerabilities. Individually or collaboratively review system designs, source code, pipeline configurations, and communications for security gaps. Deliver results within stipulated timelines. Sharpen your saw with continuous research,1earning, and training on the latest tools and techniques; share the same with the ecosystem. Communicate well using verbal and written skills, within and outside the team.