Senior Offensive Security Engineer (Azure & Entra ID)

About Applaudo Studios

At Applaudo, talented people design, build, and scale meaningful, AI-powered solutions that create real business impact.

As an AI-native organization, we collaborate across design, development, cloud, data, and artificial intelligence to turn ideas into scalable products that transform how companies operate, make decisions, and grow.

We are building a high-performance culture grounded in five values: Empowering Excellence, Collaborative Teamwork, Unsolicited Respect, Consistent Transparency, and Efficient Communication .

Joining us means being part of an organization that is evolving intentionally, investing in modern ways of working, and leading AI-native transformation at scale.

Responsibilities

• End to end penetration testing methodology covering reconnaissance, exploitation, privilege escalation, lateral movement and reporting.
• Offensive testing of Microsoft Entra ID, including directory roles, PIM, app registrations, consent grants and Conditional Access behavior.
• Azure RBAC privilege escalation and abuse of managed identities and service principals.
• Token theft and abuse, covering access and refresh tokens, the IMDS managed identity endpoint, and the Graph and ARM APIs.
• Hands on experience with Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner.
• Attack path analysis across subscriptions and tenants, including B2B guests, multitenant apps and Azure Lighthouse.
• Active Directory and Windows privilege escalation and lateral movement.
• Working knowledge of the Microsoft Cloud Penetration Testing Rules of Engagement.
• CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
• Ability to operate in a controlled and reversible way in production cloud environments.
• Precise, timestamped record keeping of every action to support detection and response review.
• Strong spoken and written English (B2+) to explain attack paths live to client cloud administrators and managed service providers.
• Be Accountable for the Following Responsibilities: Lead identity and Azure boundary assumed breach testing across two Azure tenants.
• Start from approved footholds, including a standard user with MFA, a workload identity credential or a shell on Azure compute, and attempt privilege escalation through Entra ID roles, Azure RBAC, managed identities and service principals.
• Attempt movement between approved subscriptions and between tenants, and assess whether separation controls hold.
• Attempt to reach secrets, keys, tokens and stores of nonpublic information in Key Vault, Storage and databases.
• Assess AKS workloads where authorized, including workload identity abuse and pod to node escalation.
• Chain cloud findings with application layer findings, for example moving from a compromised application to its workload identity, to demonstrate end to end attack paths.
• Prove privileged access only through harmless read actions or approved reversible markers, without changing tenant wide settings.
• Report each objective as achieved, with the attack path and supporting evidence, or blocked, with what stopped the attempt, and report posture only observations separately as untested.
• Remove all created artifacts, including app registrations, role assignments and credentials, before testing ends.
• Retest remediated attack paths and contribute to the revalidation report.
• Escalate stop conditions within one hour and execute all testing without service disruption or data loss.
• Proven end to end offensive security experience across reconnaissance, exploitation, privilege escalation, lateral movement and reporting. Offensive testing of Microsoft Entra ID and Azure RBAC , including managed identities and service principals. Azure offensive tooling such as ROADtools, AzureHound/BloodHound, AADInternals, MicroBurst or GraphRunner. Cross subscription and cross tenant attack path analysis , plus Active Directory privilege escalation and lateral movement.
• About Us We Are Engineered Different.
• These define how we work, how we support one another, and how we hold ourselves accountable.

Requirements

• You are an offensive security professional with hands-on expertise in Microsoft Entra ID, Azure privilege escalation, and identity-driven attack paths.
• You can start from an approved foothold, assess security boundaries, and demonstrate whether controls prevent access to privileged identities and sensitive resources.
• You approach production testing carefully, keeping actions controlled, reversible, and precisely documented.
• You can explain complex attack paths to cloud administrators and security stakeholders and distinguish demonstrated exploitation from posture-only observations.
• You Bring to Applaudo the Following Competencies: Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.

Preferred

• Kubernetes and AKS offensive testing, including container escape, kubelet abuse and workload identity.
• Hybrid identity attack paths across Entra Connect, ADFS and on premises Active Directory to cloud.
• Web application and API penetration testing following OWASP WSTG and the OWASP API Security Top 10.
• Ability to read Defender for Cloud or CSPM output to plan attack paths.
• Certifications such as CARTP, CARTE, GIAC Cloud Penetration Tester (GCPN), OSCP, OSEP, CRTP or CRTE.

Benefits

• Applaudo is a place for people who want to learn fast, take ownership, and work alongside strong teams they are proud to belong to.

Note

This role operates under a contractor model for an initial period of 2 months , with the possibility of extension.