Red Team Security Consultant

Role overview

Red Team Security Consultant at Payatu

Responsibilities

• Collaborate with the Blue Team to test and enhance incident response capabilities through Red vs.Blue exercises and Purple Team workshops, identifying gaps and recommending detection/mitigation improvements.
• Design and execution of full-scope red team engagements - initial access through internal compromise to objective completion.
• Deliver results within stipulated timelines.

Employment details

• Location: Pune [India]

Application details

• (Junior to Senior - broad experience band) Are you interested in automating the build and deployment process of the application while ensuring application security?
• You are a perfect technical fit if Strong fundamentals of application, network, and Windows/Active Directory protocols.
• Should be able to suggest optimum security improvements to application and infrastructure components.
• Explain and demonstrate vulnerabilities to application/system owners; run purple-team sessions with Blue Team counterparts.

About the employer

• We are always in search of passionate people to expand our renowned Bandit family at Payatu.

Additional role details

• If yes, then Payatu is the place for you.
• In the quest for Bandits, here is an excellent opportunity we would like to share with you.
• Who we are Payatu is a GPTW certified company where we strive to create a culture of excellence, growth and innovation that empowers our employees to reach new heights in their careers.
• We are young and passionate folks driven by the power of the latest and innovative technologies in IoT, AI/ML, Blockchain, and many other advanced technologies.
• We are on the mission of making the Cyberworld safe for every organization, product, and individual.
• What we look for outside work parameters: Your expertise is your primary qualification, not your degree or certification.
• Your publicly known contributions are your credentials.
• Papers you have written, tools you have developed are your references.
• Your write-up reflects your interests and ethics.
• Your published exploits, CTF rankings, and Hall of Fame listings are testimonies of your work.
• Original tools or scripts you've open-sourced count in your favor.
• Your research paper was published and/or presented at a conference.
• You are learning from the community and enthusiastically contributing back.
• Design and execute advanced penetration testing, vulnerability assessments, and simulated attack scenarios (Red Team, Purple Team) to identify security weaknesses across an organization's systems, networks, cloud, and applications.
• Utilize a variety of tools and techniques to develop and implement sophisticated attack strategies, mimicking the tactics, techniques, and procedures used by real-world adversaries.
• Document and communicate detailed findings - vulnerabilities, exploit chains, and remediation guidance - in clear, actionable reports for technical and executive stakeholders.
• Stay current with emerging threats and attack vectors; develop or customize tools, scripts, and techniques to enhance Red Team capabilities.
• Strong planning and execution of social engineering attacks - phishing, vishing, pretexting, baiting, and tailgating - to assess human vulnerabilities and insider-threat risk.
• Solid grounding in web application security with hands-on pen testing experience, preferably including regulated or financial-domain applications.
• Good command of at least one programming/scripting language for tooling and automation.
• You Have All Our Desired Qualities, if Hands-on Active Directory exploitation and lateral movement experience, including credential attacks, privilege escalation, and abuse of trust relationships.
• Comfortable with attack-path mapping tools and holds a recognized AD-focused certification.
• Offensive experience across major cloud and identity platforms, including privilege escalation, token/credential abuse, and misconfiguration exploitation.
• Ability to assess cloud landing zones and enterprise perimeter/identity infrastructure end-to-end.
• Named, hands-on experience with command-and-control frameworks - not just conceptual familiarity.
• Practical defense-evasion skills against modern endpoint protection and detection controls.
• Understanding of C2 infrastructure design and operational security practices.
• Experience threat-modeling and adversarial testing AI/LLM-powered applications and agentic systems.
• Exposure to building or red-teaming AI-augmented offensive tooling or automation pipelines.
• Deep web and API security expertise, including chained and business-logic vulnerabilities.
• Track record of vulnerability discovery and/or public bug bounty program participation.
• Comfortable with large-scale reconnaissance, source/asset analysis, and secrets exposure hunting.
• Experience running or supporting Purple Team exercises that translate red findings into detection improvements.
• Threat hunting fundamentals, including log telemetry analysis and familiarity with detection/monitoring platforms.
• Security assessment experience with CI/CD pipelines and build/release infrastructure.
• Container and orchestration security experience.
• You like automating stuff and writing your own tools to scale assessments.
• Experience with distributed or large-scale scanning infrastructure is a strong plus.
• Excellent written and verbal communication; able to translate technical impact into business/compliance language for non-technical stakeholders.
• Comfortable quantifying impact rather than describing findings only qualitatively.
• Can work independently and within a team, meet deadlines in a dynamic, fast-paced environment, and is self-driven, proactive, and hardworking.
• Actively working on something in the field outside of official work.
• Your everyday work will look like Security assessment of web applications, APIs, networks, Active Directory, and cloud environments across various platforms.
• Back your findings with working proof-of-concept exploits and reproducible attack chains.
• Collect evidence and maintain a detailed write-up of findings, mapped to relevant industry frameworks.
• Understand and explain results in terms of business and compliance impact.
• Provide appropriate remediation and mitigation guidance for identified vulnerabilities.
• Individually or collaboratively review system designs, source code, pipeline configurations, and communications for security gaps.
• Sharpen your saw with continuous research,1earning, and training on the latest tools and techniques; share the same with the ecosystem.
• Communicate well using verbal and written skills, within and outside the team.