Cloud Testing (Remote)

Trace3•Nashville, TN

3d•Remote

About The Position

Trace3 is hiring a Senior Architect, Offensive Security to lead advanced offensive security engagements for clients. The role focuses on cloud security testing—particularly Microsoft Azure, Entra ID, and Microsoft 365—and security testing of AI/LLM-enabled applications and systems. The position uses manual, adversary-minded testing to identify vulnerabilities and realistic attack paths beyond automated scanning, then provides clear, actionable remediation guidance. General network and web application penetration-testing experience may also be used, while mobile application testing is a plus. The Senior Architect plans, executes, and reports on complex assessments; serves as a technical escalation point; and helps develop the methodologies behind Trace3’s cloud and AI security services. The role also builds trusted client relationships, leads engagement teams, mentors colleagues, and contributes to offensive security research and internal testing infrastructure. The role is remote, and travel may be required when needed.

Requirements

Bachelor’s degree in Computer Science, Information Technology, or a related technical field, or equivalent professional experience.
At least 8 years of hands-on offensive security experience.
Deep expertise in cloud penetration testing, preferably with Azure, Entra ID, and Microsoft 365.
Hands-on experience testing AI/LLM applications and agentic systems.
Strong understanding of cloud identity and access management, including OAuth 2.0, OpenID Connect, SAML, conditional access, and token-based authentication.
Working knowledge of LLM application design and deployment, including RAG architectures, embeddings and vector stores, tool-calling, and model-hosting platforms.
Proficiency in scripting and development using languages such as Python, PowerShell, Go, or Bash.
Solid foundation in traditional network, Active Directory, and web application penetration testing and common tools such as Burp Suite, BloodHound, and Metasploit.
Excellent written communication skills and ability to produce clear, client-ready reports.
Excellent oral communication and presentation skills, including the ability to present findings to C-level executives and non-technical audiences.
Strong organization, attention to detail, and time management; ability to prioritize effectively in a fast-paced, high-volume, evolving environment.
Ability to approach client requests proactively and consultatively, listen to client needs, and deliver effectively.
Ability to manage multiple and changing priorities and meet deadlines in an entrepreneurial environment.
Motivation to solve challenging problems and comfort working directly with clients.
Ability to travel when needed.

Nice To Haves

Cloud-focused certifications such as CARTP, CARTE, GCPN, or AZ-500.
Offensive security certifications such as OSCP, OSEP, OSWE, OSAI, HTB COAE, or GXPN.
Hands-on experience with AWS and/or GCP security testing in addition to Azure.
Experience testing agentic AI systems, including Model Context Protocol integrations and multi-agent workflows.
Mobile application penetration-testing experience for iOS and Android, including tools such as Frida, Objection, MobSF, and jadx, aligned to OWASP MASVS and MASTG.
Mobile-focused certifications such as GMOB or eMAPT.
Published security research, CVEs, conference talks, or contributions to open-source offensive tooling.
Experience with red team operations or adversary emulation.

Responsibilities

Lead and execute cloud security assessments and penetration tests, primarily covering Microsoft Azure, Entra ID, and Microsoft 365, and AWS or GCP as applicable.
Test cloud identity and privilege escalation, tenant and subscription attack paths, managed identities, Key Vault, storage, serverless, and AKS workloads.
Identify and exploit cloud identity weaknesses, including conditional access gaps, OAuth application and consent abuse, token theft and replay, and hybrid identity attack paths.
Assess cloud DevOps and infrastructure-as-code environments, including Azure DevOps, GitHub Actions, and Terraform, for pipeline compromise, secrets exposure, and privilege escalation.
Assess AI/ML and LLM-enabled applications and agentic systems for issues such as prompt injection, jailbreaking, sensitive data leakage, insecure output handling, excessive agency, RAG weaknesses, and model supply-chain risk.
Assess cloud platforms and infrastructure hosting AI workloads, including Azure OpenAI, Azure AI Foundry, and AWS Bedrock, for access controls, data exposure, network isolation, and enterprise data integrations.
Serve as technical lead on engagements by defining testing approaches and rules of engagement, coordinating with client stakeholders, and directing and supporting other testers.
Produce reports communicating attack narratives, risk ratings, evidence, and prioritized remediation guidance, and present findings to technical and executive audiences.
Develop and maintain cloud and AI security testing methodologies, playbooks, and checklists.
Develop scripts, tools, and automation to streamline testing and internal processes.
Research emerging cloud and AI security attack techniques and share findings through internal enablement, blog posts, and conference presentations.
Mentor junior and mid-level team members and provide technical quality reviews of their work.
Assist with the design and maintenance of internal lab infrastructure for offensive security research, development, and testing.
Build client relationships, understand client needs, and support client success.