The posting
Job Description
About You
You are an offensive security professional with hands-on expertise in Microsoft Entra ID, Azure privilege escalation, and identity-driven attack paths. You can start from an approved foothold, assess security boundaries, and demonstrate whether controls prevent access to privileged identities and sensitive resources.
You approach production testing carefully, keeping actions controlled, reversible, and precisely documented. You can explain complex attack paths to cloud administrators and security stakeholders and distinguish demonstrated exploitation from posture-only observations.
Note: This role operates under a contractor model for an initial period of 2 months, with the possibility of extension.
You Bring to Applaudo the Following Competencies:
- Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
- End to end penetration testing methodology covering reconnaissance, exploitation, privilege escalation, lateral movement and reporting.
- Offensive testing of Microsoft Entra ID, including directory roles, PIM, app registrations, consent grants and Conditional Access behavior.
- Azure RBAC privilege escalation and abuse of managed identities and service principals.
- Token theft and abuse, covering access and refresh tokens, the IMDS managed identity endpoint, and the Graph and ARM APIs.
- Hands on experience with Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.
- Attack path analysis across subscriptions and tenants, including B2B guests, multitenant apps and Azure Lighthouse.
- Active Directory and Windows privilege escalation and lateral movement.
- Working knowledge of the Microsoft Cloud Penetration Testing Rules of Engagement.
- CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
- Ability to operate in a controlled and reversible way in production cloud environments.
- Precise, timestamped record keeping of every action to support detection and response review.
- Strong spoken and written English (B2+) to explain attack paths live to client cloud administrators and managed service providers.
Nice to haves:
- Kubernetes and AKS offensive testing, including container escape, kubelet abuse and workload identity.
- Hybrid identity attack paths across Entra Connect, ADFS and on premises Active Directory to cloud.
- Web application and API penetration testing following OWASP WSTG and the OWASP API Security Top 10.
- Ability to read Defender for Cloud or CSPM output to plan attack paths.
- Certifications such as CARTP, CARTE, GIAC Cloud Penetration Tester (GCPN), OSCP, OSEP, CRTP or CRTE.
You Will Be Accountable for the Following Responsibilities:
- Lead identity and Azure boundary assumed breach testing across two Azure tenants.
- Start from approved footholds, including a standard user with MFA, a workload identity credential or a shell on Azure compute, and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities and service principals.
- Attempt movement between approved subscriptions and between tenants, and assess whether separation controls hold.
- Attempt to reach secrets, keys, tokens and stores of nonpublic information in Key Vault, Storage and databases.
- Assess AKS workloads where authorized, including workload identity abuse and pod to node escalation.
- Chain cloud findings with application layer findings, for example moving from a compromised application to its workload identity, to demonstrate end to end attack paths.
- Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant wide settings.
- Report each objective as achieved, with the attack path and supporting evidence, or blocked, with what stopped the attempt, and report posture only observations separately as untested.
- Remove all created artifacts, including app registrations, role assignments and credentials, before testing ends.
- Retest remediated attack paths and contribute to the revalidation report.
- Escalate stop conditions within one hour and execute all testing without service disruption or data loss.
Qualifications
- Proven end to end offensive security experience across reconnaissance, exploitation, privilege escalation, lateral movement and reporting.
- Offensive testing of Microsoft Entra ID and Azure RBAC, including managed identities and service principals.
- Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.
- Cross subscription and cross tenant attack path analysis, plus Active Directory privilege escalation and lateral movement.
Additional Information
About Us
We Are Engineered Different.
At Applaudo, talented people design, build, and scale meaningful, AI-powered solutions that create real business impact. As an AI-native organization, we collaborate across design, development, cloud, data, and artificial intelligence to turn ideas into scalable products that transform how companies operate, make decisions, and grow.
We are building a high-performance culture grounded in five values: Empowering Excellence, Collaborative Teamwork, Unsolicited Respect, Consistent Transparency, and Efficient Communication. These define how we work, how we support one another, and how we hold ourselves accountable.
Applaudo is a place for people who want to learn fast, take ownership, and work alongside strong teams they are proud to belong to. Joining us means being part of an organization that is evolving intentionally, investing in modern ways of working, and leading AI-native transformation at scale.
