We use PostHog and Clarity to improve the site, and Meta Pixel to measure page views and ad effectiveness. Usage data may include page addresses and browser identifiers. You can opt out of collection at any time. Details in the Privacy Policy
This job has closed and is no longer accepting applications
Trevo
Is this role relevant for you?
Job Description
About the role
Job Description
We are looking for a highly skilled professional to perform deep-dive penetration tests across diverse environments. The role focuses on identifying logical flaws and executing high-impact attacks in Cloud (Azure/AWS/GCP) and On-Premises Active Directory infrastructures. As a team member, you will design complex attack scenarios and provide strategic remediation guidance to senior stakeholders.
What you'll do
Cloud Penetration Testing: Execute complex scenarios on Azure, AWS, and GCP. Focus on Identity (Entra ID), Permissions (IAM/ARM), and exploitation of misconfigured services and resources.
Active Directory & Identity: Perform advanced attacks against On-Premise Active Directory, assessing Hybrid Identity components and the synchronization security between On-Prem and Cloud.
Research & Tool Development: Strong interpersonal communication skills and ability to work independently.
Reporting & Advisory: Deliver high-level technical reports and conduct executive presentations with clear remediation steps for developers, IT teams, and management.
Job Requirements
Experience & Skills:
3+ years’ experience in Cyber Security projects or Penetration Testing within a team environment.
Strong research and analytical skills, with a passion for solving complex security challenges.
Excellent technical writing and verbal communication skills in English and Hebrew.
Strong interpersonal communication skills, with the ability to lead projects and work independently.
Proficiency in scripting and automation (Python, PowerShell, C#, or Go).
Technical Knowledge:
Cloud (Azure, AWS, GCP): Deep understanding of Entra ID (Azure AD), ARM, and RBAC models. Proven ability to identify attack paths involving Managed Identities, Service Principals, and Graph API abuse. Knowledge of AWS/GCP IAM privilege escalation and cross-account access attacks.
Active Directory: Expert-level knowledge of Kerberos, NTLM, LDAP, and ACLs. Proficiency in ADCS Exploitation, Delegation attacks, and intricate ACL manipulation.
Networking: Deep understanding of networking protocols (TCP/IP, SMB, RPC, HTTP/S) and architecture.
Coding & Tool Development: Programming capabilities with the ability to develop custom tools, automation scripts, and offensive aids to support the team and project needs.
Nice to have
Certifications: CRTP, CARTP, CRTE, or OSCP/OSEP.
Container Security: Knowledge of Kubernetes (K8s) security and Microservices architecture.
Knowledge of Windows internals & evasion techniques.
Some projects are performed remotely, while others require on-site presence. Occasional international travel is expected.