Senior Offensive Security Engineer (Azure & Entra ID)

Applaudo Studios

7d

About The Position

Applaudo is hiring a Senior Offensive Security Engineer to conduct controlled, evidence-based offensive security testing of Microsoft Entra ID and Azure environments. The role focuses on identity-driven attack paths, Azure privilege escalation, security boundaries, and determining whether controls prevent access to privileged identities and sensitive resources. Testing must be carefully controlled, reversible, and documented, with clear distinction between demonstrated exploitation and posture-only observations.

The engineer will lead assumed-breach testing across two Azure tenants, beginning from approved footholds and assessing privilege escalation, movement between approved subscriptions and tenants, and access to sensitive resources. Testing must avoid service disruption and data loss, use only harmless read actions or approved reversible markers to prove privileged access, and include removal of created artifacts before testing ends. The role also includes retesting remediated attack paths and contributing to revalidation reporting. It operates under a contractor model for an initial two-month period, with the possibility of extension.

Requirements

• Proven end-to-end offensive security experience across reconnaissance, exploitation, privilege escalation, lateral movement, and reporting.
• Offensive testing experience with Microsoft Entra ID, including directory roles, PIM, app registrations, consent grants, and Conditional Access behavior.
• Experience with Azure RBAC privilege escalation and abuse of managed identities and service principals.
• Experience with token theft and abuse, including access and refresh tokens, the IMDS managed identity endpoint, and Graph and ARM APIs.
• Hands-on experience with Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst, or GraphRunner.
• Cross-subscription and cross-tenant attack path analysis, including B2B guests, multitenant apps, and Azure Lighthouse.
• Active Directory and Windows privilege escalation and lateral movement experience.
• Working knowledge of the Microsoft Cloud Penetration Testing Rules of Engagement.
• CVSS v3.1 scoring and regulator-ready reporting supported by reproducible evidence.
• Ability to operate in a controlled and reversible way in production cloud environments.
• Precise, timestamped record keeping of every action.
• Strong spoken and written English (B2+) to explain attack paths live to client cloud administrators and managed service providers.
• A bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.

Nice To Haves

• Kubernetes and AKS offensive testing, including container escape, kubelet abuse, and workload identity.
• Hybrid identity attack paths across Entra Connect, ADFS, and on-premises Active Directory to cloud.
• Web application and API penetration testing following OWASP WSTG and the OWASP API Security Top 10.
• Ability to read Defender for Cloud or CSPM output to plan attack paths.
• Certifications such as CARTP, CARTE, GIAC Cloud Penetration Tester (GCPN), OSCP, OSEP, CRTP, or CRTE.

Responsibilities

• Lead identity and Azure boundary assumed-breach testing across two Azure tenants.
• Start from approved footholds, such as a standard user with MFA, a workload identity credential, or a shell on Azure compute, and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities, and service principals.
• Attempt movement between approved subscriptions and tenants and assess whether separation controls hold.
• Attempt to reach secrets, keys, tokens, and stores of nonpublic information in Key Vault, Storage, and databases.
• Assess authorized AKS workloads, including workload identity abuse and pod-to-node escalation.
• Chain cloud findings with application-layer findings to demonstrate end-to-end attack paths.
• Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant-wide settings.
• Report each objective as achieved, with the attack path and supporting evidence, or blocked, with what stopped the attempt; report posture-only observations separately as untested.
• Remove all created artifacts, including app registrations, role assignments, and credentials, before testing ends.
• Retest remediated attack paths and contribute to the revalidation report.
• Escalate stop conditions within one hour and execute testing without service disruption or data loss.
• Maintain precise, timestamped records of every action to support detection and response review.
• Explain attack paths to client cloud administrators, managed service providers, and security stakeholders.

What This Job Offers

• Career Level: Senior