Manager/Deputy Manager - Information Security

Role & responsibilities

Key highlights of the role are listed below (purely indicative and not limiting):

This position would include the mentioned set of responsibilities but not limited to:

Red Teaming & Adversary Simulation

• Conduct Red Team and adversary simulation exercises.
• Perform Infrastructure, Application, API, and Cloud VAPT.
• Execute Active Directory attacks, lateral movement, and privilege escalation.
• Leverage MITRE ATT&CK for threat emulation and attack mapping.
• Perform phishing, vishing, and social engineering assessments.
• Develop custom scripts, payloads, and exploits for security testing.

Security Posture & Blue Team Collaboration

• Collaborate with SOC and Blue Teams to improve detection and response.
• Identify gaps in monitoring, logging, and alerting controls.
• Conduct post-assessment reviews and remediation workshops.
• Validate security controls through attack simulations.

Tooling, Governance & Risk Management

• Manage VAPT tools and adversary emulation platforms.
• Review security policies, standards, and procedures.
• Support risk assessments aligned with NIST, ISO 27001, and CIS Controls.
• Conduct continuous attack surface and vulnerability reviews.
• Recommend security improvements across infrastructure and applications.

Leadership & Reporting

• Mentor junior security analysts and penetration testers.
• Provide security guidance to development and IT teams.
• Prepare Red Team reports and threat assessments.
• Present findings and recommendations to stakeholders.
• Promote knowledge sharing and security best practices.

Applicants should possess the following attributes:

Offensive Security & Red Teaming

• Experience in Red Teaming, Penetration Testing, or Offensive Security.
• Strong knowledge of network security, vulnerabilities, and exploit development.

• Hands-on experience with tools like Cobalt Strike, Metasploit, Blood Hound, Mimi katz, Empire, and Burp Suite.
• Expertise in Windows, Linux, and Cloud Security (AWS, Azure, GCP).
• Proficiency in Python, PowerShell, Bash, or C/C++ scripting.

Advanced Attack Techniques

• Experience in Active Directory attacks, Kerberoasting, Pass-the-Hash, and Golden/Silver Ticket attacks.
• Ability to bypass EDR, SIEM, IDS/IPS, firewalls, and endpoint controls.
• Strong understanding of privilege escalation, persistence, and lateral movement.
• Exposure to zero-day research and exploit development.

Social Engineering & Physical Security

• Experience in phishing simulations, OSINT, and credential harvesting.
• Knowledge of physical security assessments, badge cloning, and RFID testing.

Security Frameworks & Compliance

• Working knowledge of MITRE ATT&CK, NIST, ISO 27001, CIS Controls, and OWASP.
• Ability to assess security controls and recommend improvements.

Leadership & Communication

• Strong analytical, problem-solving, and investigation skills.
• Ability to present technical findings to technical and business stakeholders.
• Experience mentoring junior team members and conducting knowledge-sharing sessions.

Preferred Certifications

• OSCP, OSEP, OSCE, CRTO, GPEN, GXPN, CISSP, RTO, or equivalent certifications.