VAPT and Red Team Lead

Job Overview:

The VAPT and Red Team Lead leads an engineering-driven Offensive Security team covering vulnerability assessment, penetration testing, adversary simulation, DevSecOps, and AI security. The team identifies exploitable weaknesses, validates business impact, and supports secure product delivery.

This role combines hands-on technical leadership with team development and ownership of the offensive security roadmap.

Working with SOC, Development, DevOps, Cloud, Infrastructure, and Product teams, the lead ensures high-quality assessments, effective remediation, and measurable reduction of exploitable risks.

Responsibilities:

• Define and execute the offensive security strategy, operating model, and capability roadmap; prioritize work based on business risk and team capacity.
• Lead and develop offensive security engineers; assign engagements, review technical decisions and deliverables, and coach team members.
• Lead vulnerability assessments and black-box, grey-box, and white-box penetration tests across applications, APIs, internal services, networks, Active Directory, and cloud environments.
• Plan and lead red team engagements with clear objectives, scope, rules of engagement, and safeguards; emulate adversary TTPs to validate attack paths and demonstrate business impact.
• Oversee attack surface monitoring and vulnerability triage; validate exploitability, attack chains, and business impact, and track remediation through retesting.
• Embed threat modeling, secure code review, and SAST, DAST, SCA, secret and container scanning into the SDLC and CI/CD pipelines with engineering teams.
• Lead AI/LLM security assessments covering prompt injection, sensitive data exposure, unsafe tool use, and excessive agent permissions.
• Improve assessment methods, security tooling, and automation using scripts, APIs, and AI-assisted workflows with appropriate human review.
• Set reporting and evidence standards; deliver reproducible findings and practical remediation guidance, and coordinate resolution of critical risks before release.
• Track assessment coverage, delivery quality, remediation time, and recurring weaknesses; communicate risks, capability gaps, and improvement priorities to management.

Requirements:

• 7+ years of cybersecurity experience, including at least 5 years in penetration testing, application security, or offensive security.
• Proven experience leading security engineers and technical initiatives, developing team capabilities, and managing assessment priorities and stakeholders.
• Deep hands-on knowledge of web and API security, including authentication, authorization, business logic, vulnerability chaining, and exploit validation.
• Practical experience assessing IT products such as Web Applications, Mobile Applications, Desktop Applications, Network Services, and conducting source-code security reviews.
• Strong knowledge of Windows, Linux, Active Directory, network protocols, and cloud attack paths; familiarity with Docker and Kubernetes security.
• Experience with adversary simulation, MITRE ATT&CK, and red team tools and techniques; ability to design realistic attack scenarios and validate paths to critical assets.
• Practical experience with threat modeling to identify trust boundaries, map attack paths, and prioritize security testing; knowledge of OWASP Top 10, API Security Top 10, WSTG, and ASVS.
• Experience with DevSecOps, GitLab or equivalent CI/CD platforms, and integrating and tuning application, dependency, secret, and container security tools.
• Proficiency with Burp Suite and vulnerability assessment tools; scripting and security automation skills in Python, PowerShell, Bash, Go, or similar languages.
• Working knowledge of AI/LLM application risks and security testing, including prompt injection, data leakage, and agent/tool access controls.
• Strong leadership, systems thinking, technical decision-making, and reporting skills; ability to explain risks and agree remediation priorities across teams.
• Certifications such as OSCP, OSWE, OSEP, BSCP, or CRTO, or equivalent practical qualifications, are preferred but not mandatory.