Penetration Tester – Cloud, Data & Agentic AI (Dubai)

PENETRATION TESTER – CLOUD, DATA & AGENTIC AI

• Location: XenonStack Software Limited, DIFC, Dubai, UAE | Work from Office
• Experience: 5–10 years | Employment: Full-time, XenonStack Software Limited | Team: Cybersecurity / Security Assurance / Agentic AI Security
• Role Level: Experienced Individual Contributor

ABOUT XENONSTACK

XenonStack is a Data and AI Foundry for Agentic Systems, enabling enterprises to design, deploy, operate, and scale intelligent agents across digital and physical environments.

We build enterprise-grade platforms across the agentic stack

• Akira AI – Reasoning and agent orchestration.
• ElixirData – Context OS for enterprise data intelligence, knowledge graphs, contextual retrieval, and governed analytics.
• NexaStack – Agentic infrastructure automation. Secure, compliant AI deployment across cloud, edge, and on-premises environments.
• MetaSecure – Trust, compliance, and defense. Continuous assurance with AI-BOMs, risk scoring, and agentic security.
• Our mission is to accelerate the world's transition to AI + Human Intelligence by making agentic systems reliable, responsible, and enterprise-ready.

ABOUT THE ROLE

We are looking for a Penetration Tester – Cloud, Data & Agentic AI with 5–10 years of hands-on experience in application security, API penetration testing, cloud infrastructure, Kubernetes, and enterprise security assessments.

The candidate must possess a DESC Cyber Force-recognized penetration-testing qualification at Team Member level, with verifiable Cyber Force program experience or recognition and eligibility for registration under an approved provider.

You will perform hands-on penetration testing and security validation for enterprise and Dubai government customers, including environments where data confidentiality, system availability, regulatory compliance, and security assurance are critical.

The platforms under assessment include

• Enterprise Data Lakehouse and Analytics platforms.
• Context OS, knowledge graphs, vector databases, and AI-powered retrieval.
• Agentic AI platforms, multi-agent orchestration, and AgentOps solutions.
• Agentic Governance, Risk, and Compliance (GRC) platforms.
• Cloud-native applications, APIs, containers, Kubernetes, and identity systems.
• You will identify and validate security vulnerabilities, demonstrate realistic attack scenarios, document security findings, verify remediations, and prepare penetration-testing reports suitable for customer security reviews.
• This is a hands-on technical security role, not a security management, compliance-only, or automated vulnerability-scanning position.

ROLE MISSION

Ensure enterprise cloud, data, analytics, and Agentic AI platforms are thoroughly assessed for exploitable security vulnerabilities through hands-on penetration testing, with reproducible findings, actionable remediation recommendations, and reliable security evidence.

KEY RESPONSIBILITIES

• Penetration Testing & Security Assessment

• Execute authorized penetration-testing engagements across enterprise applications, APIs, networks, and cloud infrastructure.
• Perform black-box, grey-box, and white-box penetration testing using recognized methodologies.
• Identify and validate authentication bypasses, authorization weaknesses, privilege escalation, injection vulnerabilities, insecure configurations, and sensitive data exposure.
• Conduct authenticated and unauthenticated API penetration testing aligned with OWASP API Security Top 10.
• Test OAuth 2.0, OpenID Connect, JWT, RBAC, ABAC, and service-to-service authentication and authorization.
• Validate multi-tenant isolation and cross-tenant data-access controls.
• Develop controlled, non-destructive proof-of-concept exploits to demonstrate realistic attack paths and business impact.
• Perform manual security testing beyond automated vulnerability-scanning results.

• Cloud & Kubernetes Security

• Perform penetration testing of Microsoft Azure and approved private-cloud environments.
• Assess Kubernetes clusters, container workloads, API gateways, ingress controllers, and network segmentation.
• Identify insecure IAM permissions, workload identity weaknesses, exposed secrets, and container security risks.
• Validate private networking, restricted egress, secrets management, and boundaries between staging and production.
• Assess CI/CD pipelines, deployment credentials, container registries, and software supply-chain risks.

• Data Lakehouse & Analytics Security

• Assess data ingestion pipelines, storage layers, query engines, and analytics services.
• Evaluate security controls across Spark-based processing, Apache Iceberg, Trino, object storage, and related data-platform components.
• Test data-access permissions, service credentials, API integrations, and access to sensitive datasets.
• Identify potential sensitive-information exposure, unauthorized data extraction, and access-control weaknesses.
• Validate encryption, data segregation, auditability, and secure data movement between platform components.
• Assess whether analytics services and AI workloads can bypass underlying data-access policies.

• Agentic AI, LLM & Context OS Security

• Perform adversarial security testing of LLM-powered applications, AI agents, and multi-agent workflows.
• Assess direct and indirect prompt injection, tool-output manipulation, sensitive-information disclosure, and unauthorized agent actions.
• Test MCP servers, tool integrations, agent gateways, and agent-to-agent communication.
• Identify tool-permission escalation, confused-deputy vulnerabilities, and unsafe agent execution paths.
• Validate agent authentication, authorization, sandboxing, approval workflows, and runtime security boundaries.
• Assess RAG pipelines, knowledge retrieval, vector databases, and ContextGraph access controls.
• Evaluate whether malicious retrieved content can influence agent behavior or cause unauthorized access to enterprise systems.

• Agentic GRC & AgentOps Security

• Test agent discovery and inventory controls for identifying authorized and unauthorized AI agents.
• Validate shadow-agent detection mechanisms and potential inventory-evasion scenarios.
• Assess excessive permissions, permission inheritance, dormant access, and unauthorized tool execution.
• Test agent identity lifecycle, delegated access, and least-privilege enforcement.
• Validate approval gates for sensitive or privileged agent actions.
• Test policy-enforcement failures, audit-trail integrity, and agent activity monitoring.
• Identify potential bypasses in agent governance and runtime security controls.
• Assess security isolation between agent execution, monitoring, governance, and operational control planes.

• DESC Cyber Force & Security Compliance

• Perform penetration-testing activities in accordance with applicable DESC Cyber Force program requirements.
• Maintain the individual qualifications and records necessary for registration with an approved Cyber Force service provider.
• Follow CREST-aligned penetration-testing practices and customer-approved assessment methodologies.
• Prepare technical penetration-testing reports, vulnerability findings, supporting evidence, and remediation recommendations.
• Maintain reproducible evidence of vulnerabilities, affected assets, exploitability, and business impact.
• Support applicable DESC Information Security Regulation (ISR 3.1) control mapping and customer security assessments.
• Work with customer Information Security, Security Operations, and engineering teams to clarify security findings.
• Follow approved reporting, escalation, confidentiality, and evidence-handling procedures.
• Perform testing only within authorized scope and agreed Rules of Engagement.

• Vulnerability Remediation & Security Validation

• Classify vulnerabilities using CVSS and contextual business-risk assessment.
• Work with engineering and infrastructure teams to explain findings and remediation approaches.
• Independently retest vulnerabilities after security fixes are implemented.
• Verify that remediation closes the original attack path without introducing new security weaknesses.
• Maintain evidence-based remediation status and residual-risk documentation.
• Support formal security assessment closure and customer review processes.

HOW WE WORK WITH AI

• AI is part of the daily workflow at XenonStack, not an add-on.
• At our Dubai office, approved AI tools may be used for security research, code analysis, threat modeling, test planning, and documentation.
• Client systems, configurations, credentials, sensitive information, source code, and assessment evidence must never be exposed to unapproved external AI services.
• AI-generated security findings, exploitation approaches, and recommendations must be independently reviewed and technically validated.
• AI-assisted penetration testing must remain within explicitly authorized scope and approved Rules of Engagement.
• Production and critical operational systems require safeguards to prevent disruption, accidental data modification, or unauthorized information disclosure.
• Come ready to explain how you use AI responsibly to improve penetration-testing effectiveness without compromising evidence quality or customer confidentiality.

WHAT SUCCESS LOOKS LIKE

• All assigned penetration-testing activities are completed within approved scope and assessment timelines.
• Security vulnerabilities are identified through effective manual and automated testing.
• All formal assessment reports meet applicable Cyber Force and customer reporting requirements.
• Every reported vulnerability includes reproducible technical evidence, business impact, and actionable remediation guidance.
• Critical and High vulnerabilities are accurately validated, prioritized, and tracked through remediation or authorized risk acceptance.
• All assigned remediation retests are completed with documented verification results.
• No penetration-testing activity causes avoidable disruption to critical customer services.
• Zero unauthorized exposure of customer data, credentials, or confidential assessment evidence.
• Cloud, API, data lakehouse, and Agentic AI security risks are covered through documented, risk-based testing scenarios.
• Security findings are clearly communicated to engineering and customer security stakeholders.

MUST-HAVE SKILLS

• Certification: OSCP preferred; CREST CRT, GPEN, GWAPT or another DESC Cyber Force-approved Penetration Testing Team Member certification accepted.
• Application & API penetration testing: Strong practical expertise in OWASP Top 10, OWASP API Security Top 10, authentication and authorization testing, business-logic vulnerabilities, and API abuse.
• Cloud & Kubernetes security: Hands-on experience testing Azure environments, Kubernetes deployments, containers, IAM, networking, and secrets management.
• Penetration-testing tools: Strong proficiency with Burp Suite Professional, Nmap, Metasploit, Nuclei, Wireshark, and related security-assessment tools.
• Identity & access security: Experience testing OAuth 2.0, OIDC, JWT, RBAC, ABAC, service accounts, privileged identities, and multi-tenant authorization.
• Data-platform security: Understanding of enterprise data architectures, SQL security, data-access controls, ingestion pipelines, object storage, and analytics systems.
• AI & Agentic security: Practical understanding of LLM applications, prompt injection, RAG, AI agents, MCP tool integrations, agent permissions, and emerging AI security attack patterns.
• Security assessment methodology: Experience with CREST-aligned testing, OWASP Web Security Testing Guide, PTES, and risk-based penetration-testing practices.
• Compliance & reporting: Familiarity with DESC requirements, Dubai government security standards, CVSS, evidence handling, and formal VAPT reporting.
• Technical scripting: Ability to use Python, Bash, or equivalent languages for security testing, automation, and proof-of-concept development.
• Technical communication: Ability to explain security vulnerabilities, demonstrate their impact, and provide actionable remediation guidance to engineering and customer security teams.

GOOD-TO-HAVE SKILLS

• Previous penetration-testing engagements for Dubai government, semi-government, healthcare, or critical infrastructure organizations.
• Experience working with DESC Cyber Force-certified penetration-testing service providers.
• Advanced certifications such as OSEP, OSWE, CREST CCT APP, CREST CCT INF, or GXPN.
• Security testing experience with Microsoft Azure, Azure OpenAI, private cloud, and UAE-hosted AI infrastructure.
• Hands-on experience with Apache Spark, Apache Iceberg, Trino, MinIO, or equivalent enterprise data platforms.
• Kubernetes and container security tools such as Trivy, kube-bench, Falco, or equivalent technologies.
• Familiarity with OWASP LLM and Agentic AI security guidance and MITRE ATLAS.
• Experience testing identity and authorization enforcement for AI agents and MCP servers.
• Understanding of agent governance, shadow AI, excessive permissions detection, AI-BOMs, and runtime policy enforcement.
• Experience with SIEM, SOC operations, security telemetry, and vulnerability management platforms.
• Experience validating security controls in isolated or restricted-egress environments.
• Familiarity with ISO/IEC 27001, NIST security standards, and healthcare information-security requirements.
• Experience with source-code-assisted penetration testing and secure SDLC practices.

CANDIDATE PROFILE

• 5–10 years of hands-on experience in penetration testing, offensive security, application security, or related cybersecurity roles.
• Proven experience performing manual penetration testing and validating exploitable vulnerabilities.
• Holds at least one DESC Cyber Force-approved Team Member certification for penetration testing.
• Has verifiable Cyber Force program experience or recognition and meets the prerequisites for registration under an approved service provider.
• Eligible to obtain and maintain applicable Dubai Police clearance and customer-required background verification.
• Practical experience assessing cloud-native platforms, APIs, identity systems, and enterprise applications.
• Understanding of modern AI security threats, data-platform vulnerabilities, and cloud security architecture.
• Experience preparing formal VAPT reports for enterprise, regulated, or government customers.
• Ability to manage sensitive customer data and security evidence with strict confidentiality.
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related field; equivalent demonstrated experience will be considered.
• Strong analytical thinking, problem-solving, technical documentation, and communication skills.
• Comfortable working from the XenonStack office in DIFC, Dubai, and attending customer-site assessments as required.
• We value penetration testers who can identify exploitable vulnerabilities, demonstrate realistic attack paths, explain their impact, and verify remediation—not simply generate automated vulnerability-scanner reports.
• Be ready to demonstrate how you identified an authentication or authorization bypass, performed API penetration testing, validated cloud misconfigurations, documented security findings, and verified that a vulnerability was effectively remediated.
• Hands-on penetration-testing experience is essential. Security compliance, vulnerability scanning, or audit experience alone is not sufficient for this role.

HIRING PROCESS

Pre-screening assessment (approximately 12 minutes, at application) → Cyber Force certification and eligibility verification → Technical interview → Practical hands-on penetration-testing assessment → Face-to-face technical interview at the XenonStack DIFC office → HR and Leadership round → Background verification and applicable security-clearance checks → Offer.

TERMS

• Location: Work from XenonStack Software Limited, DIFC, Dubai, UAE.
• Full-time, work-from-office position.
• Customer-site visits within Dubai or the UAE may be required.
• Immediate joiners or candidates with short notice periods preferred.
• DESC Cyber Force Team Member qualification is mandatory.
• Continued eligibility for applicable Cyber Force recognition, professional certifications, and security clearance is required.
• Background verification is mandatory.
• Testing activities are subject to customer authorization, approved scope, and applicable regulatory requirements.
• Compensation as per company policy, UAE employment terms, and approved budget band.

HOW WE WORK

• We value deep work, clarity, and execution over activity. You will be expected to clarify, plan, execute, and escalate with options, not wait to be told.
• Ownership sits with the individual, and outcomes are measured, not effort.
• Security findings must be backed by evidence, remediation must be independently verified, and customer trust must never be compromised.

OUR VALUES

Agency – Be self-directed and proactive | Taste – Sweat the details and build with precision | Ownership – Take responsibility for outcomes | Mastery – Commit to continuous learning and growth | Impatience – Move fast and challenge inertia | Customer Obsession – Always put the customer first

WHY JOIN US

• Perform hands-on penetration testing for enterprise and government-sector platforms in Dubai.
• Work at the intersection of cybersecurity, cloud infrastructure, enterprise data platforms, and Agentic AI.
• Assess emerging AI security risks, including unauthorized agents, excessive permissions, unsafe tool execution, and autonomous workflows.
• Collaborate with platform engineering, AgentOps, SRE, governance, and customer security teams.
• Gain exposure to advanced Context OS, data lakehouse, AI orchestration, and security-governance technologies.
• Work in an AI-first engineering environment using approved AI capabilities to improve the depth and efficiency of security assessments.
• Contribute to the security and trustworthiness of enterprise AI platforms deployed in regulated environments.
• Be part of a Great Place to Work-Certified organization with 14+ years of experience and headquarters in Mohali, India.