Penetration Tester – Cloud, Data & Agentic AI (Dubai) بدوام كامل في دبي
التخصص
تكنولوجيا المعلومات
نوع الدوام
دوام كامل
الخبرة
أي مستوى
الموقع
دبي
وصف الوظيفة
PENETRATION TESTER – CLOUD, DATA & AGENTIC AILocation: XenonStack Software Limited, DIFC, Dubai, UAE | Work from OfficeExperience: 5–10 years | Employment: Full-time, XenonStack Software Limited | Team: Cybersecurity / Security Assurance / Agentic AI SecurityRole Level: Experienced Individual ContributorAbout XenonstackXenonStack is a Data and AI Foundry for Agentic Systems, enabling enterprises to design, deploy, operate, and scale intelligent agents across digital and physical environments.We Build Enterprise-grade Platforms Across The Agentic StackAkira AI – Reasoning and agent orchestration.ElixirData – Context OS for enterprise data intelligence, knowledge graphs, contextual retrieval, and governed analytics.NexaStack – Agentic infrastructure automation. Secure, compliant AI deployment across cloud, edge, and on-premises environments.MetaSecure – Trust, compliance, and defense. Continuous assurance with AI-BOMs, risk scoring, and agentic security.Our mission is to accelerate the world's transition to AI + Human Intelligence by making agentic systems reliable, responsible, and enterprise-ready.About The RoleWe are looking for a Penetration Tester – Cloud, Data & Agentic AI with 5–10 years of hands-on experience in application security, API penetration testing, cloud infrastructure, Kubernetes, and enterprise security assessments.The candidate must possess a DESC Cyber Force-recognized penetration-testing qualification at Team Member level, with verifiable Cyber Force program experience or recognition and eligibility for registration under an approved provider.You will perform hands-on penetration testing and security validation for enterprise and Dubai government customers, including environments where data confidentiality, system availability, regulatory compliance, and security assurance are critical.The Platforms Under Assessment IncludeEnterprise Data Lakehouse and Analytics platforms.Context OS, knowledge graphs, vector databases, and AI-powered retrieval.Agentic AI platforms, multi-agent orchestration, and AgentOps solutions.Agentic Governance, Risk, and Compliance (GRC) platforms.Cloud-native applications, APIs, containers, Kubernetes, and identity systems.You will identify and validate security vulnerabilities, demonstrate realistic attack scenarios, document security findings, verify remediations, and prepare penetration-testing reports suitable for customer security reviews.This is a hands-on technical security role, not a security management, compliance-only, or automated vulnerability-scanning position.ROLE MISSIONEnsure enterprise cloud, data, analytics, and Agentic AI platforms are thoroughly assessed for exploitable security vulnerabilities through hands-on penetration testing, with reproducible findings, actionable remediation recommendations, and reliable security evidence.Key Responsibilities Penetration Testing & Security AssessmentExecute authorized penetration-testing engagements across enterprise applications, APIs, networks, and cloud infrastructure.Perform black-box, grey-box, and white-box penetration testing using recognized methodologies.Identify and validate authentication bypasses, authorization weaknesses, privilege escalation, injection vulnerabilities, insecure configurations, and sensitive data exposure.Conduct authenticated and unauthenticated API penetration testing aligned with OWASP API Security Top 10.Test OAuth 2.0, OpenID Connect, JWT, RBAC, ABAC, and service-to-service authentication and authorization.Validate multi-tenant isolation and cross-tenant data-access controls.Develop controlled, non-destructive proof-of-concept exploits to demonstrate realistic attack paths and business impact.Perform manual security testing beyond automated vulnerability-scanning results. Cloud & Kubernetes SecurityPerform penetration testing of Microsoft Azure and approved private-cloud environments.Assess Kubernetes clusters, container workloads, API gateways, ingress controllers, and network segmentation.Identify insecure IAM permissions, workload identity weaknesses, exposed secrets, and container security risks.Validate private networking, restricted egress, secrets management, and boundaries between staging and production.Assess CI/CD pipelines, deployment credentials, container registries, and software supply-chain risks. Data Lakehouse & Analytics SecurityAssess data ingestion pipelines, storage layers, query engines, and analytics services.Evaluate security controls across Spark-based processing, Apache Iceberg, Trino, object storage, and related data-platform components.Test data-access permissions, service credentials, API integrations, and access to sensitive datasets.Identify potential sensitive-information exposure, unauthorized data extraction, and access-control weaknesses.Validate encryption, data segregation, auditability, and secure data movement between platform components.Assess whether analytics services and AI workloads can bypass underlying data-access policies. Agentic AI, LLM & Context OS SecurityPerform adversarial security testing of LLM-powered applications, AI agents, and multi-agent workflows.Assess direct and indirect prompt injection, tool-output manipulation, sensitive-information disclosure, and unauthorized agent actions.Test MCP servers, tool integrations, agent gateways, and agent-to-agent communication.Identify tool-permission escalation, confused-deputy vulnerabilities, and unsafe agent execution paths.Validate agent authentication, authorization, sandboxing, approval workflows, and runtime security boundaries.Assess RAG pipelines, knowledge retrieval, vector databases, and ContextGraph access controls.Evaluate whether malicious retrieved content can influence agent behavior or cause unauthorized access to enterprise systems. Agentic GRC & AgentOps SecurityTest agent discovery and inventory controls for identifying authorized and unauthorized AI agents.Validate shadow-agent detection mechanisms and potential inventory-evasion scenarios.Assess excessive permissions, permission inheritance, dormant access, and unauthorized tool execution.Test agent identity lifecycle, delegated access, and least-privilege enforcement.Validate approval gates for sensitive or privileged agent actions.Test policy-enforcement failures, audit-trail integrity, and agent activity monitoring.Identify potential bypasses in agent governance and runtime security controls.Assess security isolation between agent execution, monitoring, governance, and operational control planes. DESC Cyber Force & Security CompliancePerform penetration-testing activities in accordance with applicable DESC Cyber Force program requirements.Maintain the individual qualifications and records necessary for registration with an approved Cyber Force service provider.Follow CREST-aligned penetration-testing practices and customer-approved assessment methodologies.Prepare technical penetration-testing reports, vulnerability findings, supporting evidence, and remediation recommendations.Maintain reproducible evidence of vulnerabilities, affected assets, exploitability, and business impact.Support applicable DESC Information Security Regulation (ISR 3.1) control mapping and customer security assessments.Work with customer Information Security, Security Operations, and engineering teams to clarify security findings.Follow approved reporting, escalation, confidentiality, and evidence-handling procedures.Perform testing only within authorized scope and agreed Rules of Engagement. Vulnerability Remediation & Security ValidationClassify vulnerabilities using CVSS and contextual business-risk assessment.Work with engineering and infrastructure teams to explain findings and remediation approaches.Independently retest vulnerabilities after security fixes are implemented.Verify that remediation closes the original attack path without introducing new security weaknesses.Maintain evidence-based remediation status and residual-risk documentation.Support form
التعليقات
لا توجد تعليقات منشورة حتى الآن.