Cloud Penetration Tester (AWS, Azure, GCP)

Role overview Assess cloud security across AWS, Azure, and Google Cloud environments through configuration review and controlled offensive testing. Starting from realistic assumed-breach scenarios, you will trace potential privilege escalation and data access, evaluate detection coverage, and help clients prioritize remediation.

Responsibilities - Review identity policies, roles and trust relationships, storage exposure, compute and container settings, network controls, secrets handling, and logging against the relevant CIS foundations benchmark. - Test privilege escalation and data access from an assumed-breach starting point, documenting attack paths and potential blast radius. - Assess whether cloud audit logging and detection controls would capture each step. - Prepare reports with CVSS-scored findings, prioritized fixes, and requested compliance mappings, then retest remediation. - Keep testing within each provider's penetration testing policy, leave no persistent changes, and record actions with timestamps for client defenders.

Requirements - At least four years of cloud security experience, including hands-on offensive testing in two or more of AWS, Azure, and Google Cloud. - Working knowledge of infrastructure as code, containers, Kubernetes, and the identity systems of the cloud providers tested. - Based in the United States and authorized to work there; engagements follow US time zones. - Able to produce reports with actionable engineering guidance and evidence suitable for auditors; a redacted sample report is required with the application. - Comfortable following a written scope, identifying scope issues early, and providing two professional references from live engagements.

Nice to have - Internal network or Active Directory testing experience for hybrid environments. - Experience preparing cloud security evidence for SOC 2, PCI DSS, or HIPAA audits. - An offensive security certification.

Benefits and work setup Full-time, remote employment within the United States. Engagements usually run five to ten testing days plus a retest.