Senior Offensive Security Engineer (Azure & Entra ID)

About the role

Applaudo is looking for a senior offensive security professional with hands-on expertise in Microsoft Entra ID, Azure privilege escalation and identity-driven attack paths. The role works under a contractor model for an initial period of 2 months, with the possibility of extension. You will lead identity and Azure boundary assumed-breach testing across two Azure tenants, starting from approved footholds and demonstrating whether controls prevent access to privileged identities and sensitive resources.

Key responsibilities

• Start from approved footholds (e.g. a standard user with MFA, a workload identity credential or a shell on Azure compute) and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities and service principals.
• Movement between approved subscriptions and between tenants, and assessment of separation controls.
• Attempt to reach secrets, keys, tokens and stores of non-public information in Key Vault, Storage and databases.
• Assess AKS workloads where authorised, including workload identity abuse and pod-to-node escalation.
• Chain cloud findings with application-layer findings to show end-to-end attack paths.
• Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant-wide settings.
• Report each objective as achieved, blocked or posture-only, remove all created artifacts, and retest remediated paths.
• Escalate stop conditions within one hour and test without service disruption or data loss.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering or a related field, or equivalent professional experience.
• Proven end-to-end offensive security experience, including reconnaissance, exploitation, privilege escalation, lateral movement and reporting.
• Strong spoken and written English (B2+) to explain attack paths to client cloud administrators and MSPs.
• Nice to have: Kubernetes/AKS offensive testing, hybrid identity attack paths, web/API penetration testing, reading Defender for Cloud or CSPM output, and certifications such as OSCP, OSEP, CRTP, CRTE, GCPN or GIAC Cloud Penetration Tester.

Required skills

• Microsoft Entra ID offensive testing (directory roles, PIM, app registrations, consent grants, Conditional Access).
• Azure RBAC privilege escalation and abuse of managed identities and service principals.
• Token theft and abuse (access and refresh tokens, IMDS, Graph and ARM APIs).
• Hands-on use of offensive tools such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.
• Cross-subscription and cross-tenant attack path analysis, AD and Windows privilege escalation and lateral movement.
• CVSS v3.1 scoring and regulator-ready reporting; ability to work safely in production cloud environments.