Red Team Engineer – Dubai

About the role

We are looking for a skilled Red Team Engineer to join our cybersecurity practice in Dubai. You will lead offensive security engagements for enterprise clients, delivering high‑impact penetration testing, adversary emulation, and vulnerability assessments.

Key responsibilities

• Conduct network, web‑application, infrastructure, and cloud penetration testing engagements.
• Execute adversary emulation and red‑team operations using MITRE ATT&CK and PTES frameworks.
• Perform comprehensive vulnerability assessments and produce client‑facing reports in Arabic and English.
• Identify, validate, exploit, and document security flaws across cloud, on‑premises, and hybrid environments.
• Develop, customize, and maintain tools, scripts, and payloads to enhance offensive operations.
• Support the AttackForge PTaaS platform, handling engagement scoping, scheduling, findings management, and client coordination.
• Present technical findings, risk assessments, and remediation recommendations to both technical and executive stakeholders.
• Stay current on emerging threats, attack techniques, threat‑actor TTPs, and newly disclosed vulnerabilities affecting GCC organizations.
• Collaborate with Defence and Detect teams on threat‑intelligence, detection engineering, and security‑control validation.

Required profile

• Strong understanding of offensive security principles, including reconnaissance, exploitation, post‑exploitation, lateral movement, privilege escalation, and data exfiltration.
• 2–4 years of hands‑on offensive security experience (consultancy, internal red‑team, penetration testing, or relevant internships).
• Native or professional‑level proficiency in Arabic for client communication and documentation.
• Excellent written English skills for clear technical reporting.
• Ability to work independently, manage competing priorities, and deliver multiple engagements simultaneously.
• High professionalism, integrity, and strict adherence to ethical hacking standards.

Required skills

• Burp Suite
• Metasploit
• Nmap
• Nessus
• Cobalt Strike
• Python, Bash or PowerShell scripting
• Active Directory attack techniques (Kerberoasting, Pass‑the‑Hash, BloodHound)
• OWASP Top 10 knowledge
• Cloud security assessment experience in AWS, Azure or GCP (advantageous)
• AttackForge PTaaS platform familiarity