{"id":2293800,"url":"https://alion.io/job/paramount-computer-systems-security-tester","title":"Security Tester","company":{"id":48613,"name":"Paramount Computer Systems","domain":"paramountassure.com","url":"https://alion.io/company/paramountassure","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"A","score":92,"open_postings":69,"ghost_share":0.043,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":225,"computed_at":"2026-10-17T05:46:00Z"}},"role":"QA","role_family":"QA","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"GraphQL","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"Metasploit","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Nmap","optional":false},{"name":"Nuclei","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rest API","optional":false},{"name":"SQLmap","optional":false},{"name":"GitHub Actions","optional":true},{"name":"GitLab CI","optional":true},{"name":"Llama","optional":true},{"name":"LLM Guardrails","optional":true},{"name":"Multi-Agent Systems","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"Promptfoo","optional":true}],"status":"live","first_seen_at":"2026-07-06T12:50:24Z","employer_posted_date":"2026-07-06","last_verified_at":"2026-10-17T11:37:48Z","board_verified":true,"closed_at":null,"days_open":103,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":102},"description":"Security Tester\nAI-Native Application Security & VAPT\nTeam: Security Engineering\nLocation: Hybrid (India-Coimbatore)\nEmployment type: Full-time\nExperience: 2.5+ years\nReports to: Security Engineering Lead\nWhy This Role Exists\nMost security testers were trained to break software that behaves the same way every time you poke it. That world is gone. We build AI-native applications - LLM-backed products, RAG pipelines, and autonomous agents that reason, call tools, and make decisions on their own. These systems fail in ways a classic scanner will never catch: a politely worded sentence can override a system prompt, a poisoned document can hijack an agent mid-task, and a “helpful” tool call can quietly exfiltrate data.\nWe’re looking for a Security Tester who is equally comfortable running a full VAPT engagement against a web app or cloud stack and red-teaming a model that talks back. You’ll be the person who thinks like an attacker in a world where the target can be convinced, not just exploited.\nWhat You’ll Actually Do\nOwn end-to-end VAPT engagements across web apps, REST/GraphQL APIs, cloud infrastructure, and internal networks - from scoping and threat modelling to exploitation, reporting, and retesting.\n Red-team AI-native applications: prompt injection (direct and indirect), jailbreaks, system-prompt leakage, insecure output handling, RAG poisoning, training-data extraction, model denial-of-service, and excessive-agency abuse in agentic systems.\n Break agents and their tool-chains: test tool/function-calling boundaries, MCP (Model Context Protocol) server exposure, sandbox escapes, and privilege escalation through chained tool calls.\n Map findings to real frameworks - OWASP Top 10, OWASP LLM Top 10, OWASP Agentic Security (ASI), MITRE ATT&CK, and MITRE ATLAS - so remediation is grounded, not hand-wavy.\nScore and prioritize vulnerabilities using CVSS, with clear, reproducible proof-of-concept and business-impact context that both engineers and leadership can act on.\nWrite reports people read: crisp, developer-friendly write-ups with reproduction steps, evidence, and pragmatic remediation guidance - not a wall of scanner output.\n Shift security left: help embed automated security testing (SAST, SCA, DAST, secret scanning, IaC scanning, LLM red-team checks) into CI/CD pipelines and PR gates.\nRetest and verify fixes, track remediation to closure, and partner with engineering to make the fix stick.\nStay ahead of the curve - track emerging AI attack techniques and feed new test cases back into our internal red-team playbooks.\n\nWhat We Need From You (Must-Haves)\n 2.5+ years of hands-on offensive security / penetration testing experience.\nDemonstrated experience with the full VAPT lifecycle for web, API, and cloud targets - you can scope, exploit, and communicate, not just run a tool.\nStrong grasp of the OWASP Top 10 and common web/API vulnerability classes (authn/authz flaws, injection, SSRF, IDOR, deserialization, misconfigurations).\nWorking knowledge of LLM and AI application attack surfaces - prompt injection, jailbreaks, insecure output handling, and the OWASP LLM Top 10 - or a clear, provable appetite to go deep here fast.\nHands-on with core offensive tooling: Burp Suite, OWASP ZAP, Nmap, Nuclei, Metasploit, sqlmap, and similar.\nComfortable in at least one scripting language (Python strongly preferred) to build custom exploits, harnesses, and automation.\nSolid understanding of web protocols, authentication/authorization (OAuth 2.0 / OIDC, JWT, session management) and how they break.\nFamiliarity with cloud security fundamentals (AWS, Azure, or GCP) and containerized environments (Docker, Kubernetes).\nAbility to write clear, prioritized, reproducible reports and explain risk to both engineers and non-technical stakeholders.\n\nWhat Will Make You Stand Out (Nice-to-Haves)\nHands-on experience with LLM/agent red-teaming frameworks: Garak, PyRIT, DeepTeam, promptfoo, or Microsoft’s AI Red Teaming Agent.\nExperience with AI guardrail / defense tooling: Lakera Guard, Rebuff, Llama Prompt Guard, or custom prompt-injection classifiers.\nFamiliarity with MCP security and agent-sandboxing concepts (MCP Scan, tool-permission boundaries, isolation).\nExposure to RAG pipeline security, vector-store poisoning, and multi-agent orchestration risks.\nKnowledge of MITRE ATLAS and the NIST AI Risk Management Framework (AI RMF).\nExperience integrating security testing into CI/CD (GitHub Actions, GitLab CI) and policy-as-code gating (OPA / Rego).\nCloud-native security experience with Kubernetes (RBAC, network policies, admission control).\nBug-bounty track record, CTF wins, published research, or CVEs to your name.\n\nCertifications (A Plus, Not a Gate)\nOSCP, OSWE, eWPT/eWPTX, GPEN, GWAPT, CEH, or AI-security-specific credentials. We care more about what you can break than what’s on paper.","description_format":"text","description_chars":4846,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Compliance","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-11T19:42:23Z"}],"visa":[],"liveness":{"score":64,"band":"ok","label":"Likely open","p_open":1,"p_active":0.884,"p_room":0.72,"age_days":102,"expected_fill_days":225,"reasons":["conf:0","velocity","win:mid","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/paramount-computer-systems-security-tester","json_url":"https://alion.io/job/paramount-computer-systems-security-tester.json","meta":{"generated_at":"2026-10-17T14:47:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19939,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48613},"rest":"https://alion.io/mcp/rest/get_company?id=48613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fparamount-computer-systems-security-tester"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fparamount-computer-systems-security-tester"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fparamount-computer-systems-security-tester"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/paramount-computer-systems-security-tester\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fparamount-computer-systems-security-tester"}]}