Senior Cybersecurity Specialist

at Fonada

Senior Cybersecurity Specialist

Fonada

Company

Home

Senior Cybersecurity Specialist

at Fonada

Posted by Karandeep Singh

7 - 10 yrs

₹15L - ₹20L / yr

Noida

Skills

Cyber Security

Information security

Network Security

DevSecOps

Ethical Hacking

Penetration testing

GRC

VAPT

Python

ISO/IEC 27001:2022

About the Role

We are seeking an experienced Cyber Security Specialist who can operate across both offensive and defensive security disciplines. This dual-role professional will lead Vulnerability Assessment and Penetration Testing (VAPT) engagements, act as the in-house Red Team to simulate real-world adversaries, and own the implementation and continuous improvement of the Information Security Management System (ISMS) aligned with ISO/IEC 27001 and related standards. You will combine hands-on offensive security work with governance, audit readiness, and stakeholder engagement across engineering, IT, legal, and executive leadership.

Key Responsibilities

VAPT & Red Team Operations

Plan, scope, and execute end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements across web applications, mobile apps, APIs, networks, cloud environments, wireless, and physical infrastructure.
Act as the organization's in-house Red Team, simulating advanced persistent threat (APT) actors through adversary emulation, social engineering, phishing campaigns, and physical intrusion testing where authorized.
Design and execute Red Team operations aligned with MITRE ATT&CK, TIBER-EU, and similar frameworks; develop custom Tactics, Techniques, and Procedures (TTPs).
Conduct manual and automated exploitation, post-exploitation, lateral movement, privilege escalation, and persistence testing in production-like environments.
Develop custom exploits, payloads, scripts, and tooling (Python, PowerShell, Bash, C/C++, Go) to bypass security controls during sanctioned engagements.
Perform source code reviews, threat modeling, and secure architecture reviews of new and existing systems.
Coordinate Purple Team exercises with the Blue Team / SOC to validate detection coverage and improve defensive playbooks.
Produce high-quality VAPT and Red Team reports with executive summaries, technical findings, proof-of-concept exploits, risk ratings (CVSS), and prioritized remediation guidance.
Re-test remediated findings and track closure with engineering and IT teams through to verification.

ISO Compliance & Governance

Lead the implementation, maintenance, and continual improvement of the ISMS in line with ISO/IEC 27001:2022, including scope definition, Statement of Applicability (SoA), and risk treatment plans.
Own and maintain ISO policies, procedures, controls, and documentation across the organization, ensuring alignment with ISO 27001, ISO 27017, ISO 27018, and ISO 22301.
Plan and coordinate internal and external audits; serve as the primary liaison with certification bodies, auditors, and regulators.
Conduct risk assessments, business impact analyses (BIA), and threat modeling; maintain a central risk register and drive remediation.
Map VAPT and Red Team findings to ISO 27001 Annex A controls and feed results into the risk management lifecycle.
Support compliance with adjacent frameworks: SOC 2, NIST CSF, GDPR, HIPAA, PCI-DSS, and DPDP Act (India), as applicable.
Define and report security and compliance KPIs/KRIs to senior leadership; prepare materials for management reviews and board updates.
Develop and deliver security awareness training, phishing simulations, and role-based secure-coding training.
Drive third-party / vendor risk management, including security questionnaires, contractual clauses, and ongoing monitoring.
Partner with engineering and DevOps to embed security into the SDLC, CI/CD pipelines, and cloud architectures (DevSecOps).

Incident Response & Continuous Improvement

Support incident response activities: detection, triage, containment, eradication, recovery, and post-incident reviews.
Maintain business continuity and disaster recovery plans; coordinate BCP/DR testing and tabletop exercises.
Stay current on emerging threats, CVEs, attacker techniques, regulatory changes, and ISO standard updates; recommend and drive improvements.

Required Qualifications

8+ years of progressive experience in cyber security, with at least 4 years in hands-on offensive security (VAPT, penetration testing, or Red Team) and 3+ years in ISO 27001 implementation and audits.
Proven track record of leading VAPT engagements across web, mobile, API, network, cloud (AWS / Azure / GCP), and wireless environments.
Hands-on experience executing Red Team operations and adversary emulation aligned with MITRE ATT&CK.
Deep proficiency with offensive security tooling: Burp Suite Pro, Metasploit, Cobalt Strike (or open-source equivalents like Sliver, Mythic, Havoc), Nmap, Nessus, Nuclei, BloodHound, Impacket, Responder, and OWASP ZAP.
Strong scripting and exploit development skills in Python, PowerShell, Bash, and at least one compiled language (C/C++, Go, or Rust).
Proven hands-on experience leading an organization through ISO 27001 certification and surveillance audits end-to-end.
Strong working knowledge of ISO/IEC 27001:2022 (including Annex A controls), ISO 27002, ISO 27017, ISO 27018, and ISO 22301.
Solid understanding of security domains: IAM, network security, endpoint security, cloud security, application security (OWASP Top 10, API Security Top 10), and Active Directory attack paths.
Experience with risk assessment methodologies (ISO 27005, NIST 800-30) and the ability to translate offensive findings into business risk.
Strong report-writing, policy-drafting, and executive communication skills.
Bachelor's degree in Computer Science, Information Security, Engineering, or a related field (or equivalent experience).

Preferred Qualifications

Offensive security certifications: OSCP, OSEP, OSWE, OSED, CRTO, CRTP, CRTE, CRTL, GPEN, GXPN, GWAPT, or CEH Practical.
Governance certifications: ISO 27001 Lead Implementer and/or Lead Auditor, CISSP, CISM, CISA, or CRISC.
Cloud security certifications (CCSP, AWS Security Specialty, Azure Security Engineer, or GCP Professional Cloud Security Engineer).
Published CVEs, security research, bug bounty achievements, or contributions to open-source security tools.
Experience with Active Directory / Entra ID red teaming, Kerberos attacks, and modern EDR/XDR evasion techniques.
Experience with container, Kubernetes, and serverless security testing.
Experience implementing or auditing additional frameworks: SOC 2 Type II, NIST CSF, NIST 800-53, HITRUST, or PCI-DSS.
Experience with GRC platforms (Vanta, Drata, Sprinto, ServiceNow GRC, Archer, OneTrust).
Experience in regulated industries: financial services, healthcare, SaaS, or critical infrastructure.
Experience briefing executive leadership, customers, and external auditors on offensive findings and remediation strategy.

About the Role

Key Responsibilities

VAPT & Red Team Operations

Plan, scope, and execute end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements across web applications, mobile apps, APIs, networks, cloud environments, wireless, and physical infrastructure.
Act as the organization's in-house Red Team, simulating advanced persistent threat (APT) actors through adversary emulation, social engineering, phishing campaigns, and physical intrusion testing where authorized.
Design and execute Red Team operations aligned with MITRE ATT&CK, TIBER-EU, and similar frameworks; develop custom Tactics, Techniques, and Procedures (TTPs).
Conduct manual and automated exploitation, post-exploitation, lateral movement, privilege escalation, and persistence testing in production-like environments.
Develop custom exploits, payloads, scripts, and tooling (Python, PowerShell, Bash, C/C++, Go) to bypass security controls during sanctioned engagements.
Perform source code reviews, threat modeling, and secure architecture reviews of new and existing systems.
Coordinate Purple Team exercises with the Blue Team / SOC to validate detection coverage and improve defensive playbooks.
Produce high-quality VAPT and Red Team reports with executive summaries, technical findings, proof-of-concept exploits, risk ratings (CVSS), and prioritized remediation guidance.
Re-test remediated findings and track closure with engineering and IT teams through to verification.

ISO Compliance & Governance

Lead the implementation, maintenance, and continual improvement of the ISMS in line with ISO/IEC 27001:2022, including scope definition, Statement of Applicability (SoA), and risk treatment plans.
Own and maintain ISO policies, procedures, controls, and documentation across the organization, ensuring alignment with ISO 27001, ISO 27017, ISO 27018, and ISO 22301.
Plan and coordinate internal and external audits; serve as the primary liaison with certification bodies, auditors, and regulators.
Conduct risk assessments, business impact analyses (BIA), and threat modeling; maintain a central risk register and drive remediation.
Map VAPT and Red Team findings to ISO 27001 Annex A controls and feed results into the risk management lifecycle.
Support compliance with adjacent frameworks: SOC 2, NIST CSF, GDPR, HIPAA, PCI-DSS, and DPDP Act (India), as applicable.
Define and report security and compliance KPIs/KRIs to senior leadership; prepare materials for management reviews and board updates.
Develop and deliver security awareness training, phishing simulations, and role-based secure-coding training.
Drive third-party / vendor risk management, including security questionnaires, contractual clauses, and ongoing monitoring.
Partner with engineering and DevOps to embed security into the SDLC, CI/CD pipelines, and cloud architectures (DevSecOps).

Incident Response & Continuous Improvement

Support incident response activities: detection, triage, containment, eradication, recovery, and post-incident reviews.
Maintain business continuity and disaster recovery plans; coordinate BCP/DR testing and tabletop exercises.
Stay current on emerging threats, CVEs, attacker techniques, regulatory changes, and ISO standard updates; recommend and drive improvements.

Required Qualifications

8+ years of progressive experience in cyber security, with at least 4 years in hands-on offensive security (VAPT, penetration testing, or Red Team) and 3+ years in ISO 27001 implementation and audits.
Proven track record of leading VAPT engagements across web, mobile, API, network, cloud (AWS / Azure / GCP), and wireless environments.
Hands-on experience executing Red Team operations and adversary emulation aligned with MITRE ATT&CK.
Deep proficiency with offensive security tooling: Burp Suite Pro, Metasploit, Cobalt Strike (or open-source equivalents like Sliver, Mythic, Havoc), Nmap, Nessus, Nuclei, BloodHound, Impacket, Responder, and OWASP ZAP.
Strong scripting and exploit development skills in Python, PowerShell, Bash, and at least one compiled language (C/C++, Go, or Rust).
Proven hands-on experience leading an organization through ISO 27001 certification and surveillance audits end-to-end.
Strong working knowledge of ISO/IEC 27001:2022 (including Annex A controls), ISO 27002, ISO 27017, ISO 27018, and ISO 22301.
Solid understanding of security domains: IAM, network security, endpoint security, cloud security, application security (OWASP Top 10, API Security Top 10), and Active Directory attack paths.
Experience with risk assessment methodologies (ISO 27005, NIST 800-30) and the ability to translate offensive findings into business risk.
Strong report-writing, policy-drafting, and executive communication skills.
Bachelor's degree in Computer Science, Information Security, Engineering, or a related field (or equivalent experience).

Preferred Qualifications

Offensive security certifications: OSCP, OSEP, OSWE, OSED, CRTO, CRTP, CRTE, CRTL, GPEN, GXPN, GWAPT, or CEH Practical.
Governance certifications: ISO 27001 Lead Implementer and/or Lead Auditor, CISSP, CISM, CISA, or CRISC.
Cloud security certifications (CCSP, AWS Security Specialty, Azure Security Engineer, or GCP Professional Cloud Security Engineer).
Published CVEs, security research, bug bounty achievements, or contributions to open-source security tools.
Experience with Active Directory / Entra ID red teaming, Kerberos attacks, and modern EDR/XDR evasion techniques.
Experience with container, Kubernetes, and serverless security testing.
Experience implementing or auditing additional frameworks: SOC 2 Type II, NIST CSF, NIST 800-53, HITRUST, or PCI-DSS.
Experience with GRC platforms (Vanta, Drata, Sprinto, ServiceNow GRC, Archer, OneTrust).
Experience in regulated industries: financial services, healthcare, SaaS, or critical infrastructure.
Experience briefing executive leadership, customers, and external auditors on offensive findings and remediation strategy.

Users love Cutshort

Read about what our users have to say about finding their next opportunity on Cutshort.

Shubham Vishwakarma

Full Stack Developer - Averlon

I had an amazing experience. It was a delight getting interviewed via Cutshort. The entire end to end process was amazing. I would like to mention Reshika, she was just amazing wrt guiding me through the process. Thank you team.

Companies hiring on Cutshort

About Fonada

Founded :

2014

Type :

Products & Services

Size :

20-100

Stage :

Profitable

About

Experience the future of communication with Fonada's Next-Gen CPaaS. Revolutionizing communication solutions for businesses.

Similar jobs

Digital Marketing

at Tikshark

Posted by Arushi Thakur

Noida

1 - 2 yrs

₹2L - ₹3L / yr

Social Media Marketing (SMM)

Email Marketing

JOB DESCRIPTION

Job Title: Digital Marketing Executive

Job Type: Full time

Work Location: Noida sec 62

About Us:-

Tikshark is a creative digital marketing and advertising agency. It provides a variety of online marketing and branding solutions designed to help businesses grow their online presence and reach their target audiences effectively. We specialize in providing comprehensive digital solutions designed to help businesses across the globe achieve their marketing and branding goals. At Tikshark, we don’t just market brands — we make them memorable. Our digital solutions drive visibility, engagement, and success.

JOB SUMMARY:-

We are looking for a passionate and innovative Digital Marketer to join our team at Tikshark. As part of TikShark’s team, you will help build strong digital brand presence and deliver measurable marketing impact for diverse clients. We aren't just hiring for a role; we're hiring for potential.

Roles and Responsibilities:-

· Develop and execute comprehensive digital marketing strategies aligned with client and company goals.

· Design and run paid advertising campaigns on Google Ads, Meta Ads, and other digital platforms to drive traffic and lead generation.

· Coordinate with graphic designers, video editors, and content writers to develop high-quality marketing creative.

· Research competitor activities, market trends, and emerging digital tools to stay ahead in the industry.

· Monitor and analyse campaign performance using tools such as Google Analytics, Meta Business Suite, and Search Console.

· Prepare performance reports, derive insights, and recommend improvements for better ROI.

· Assist in website content updates and landing page optimization to enhance user experience.

· Support influencer marketing and brand collaboration campaigns when required.

Preferred Skills:-

· Strong understanding of SMM, SMO, Digital Marketing fundamentals, and content strategy and email marketing tools.

. Experience in meta ads or google ads and running campaigns.

· Analytical mind set with familiarity in web analytics tools.

· Excellent communication, creativity, and attention to detail.

· Understanding of B2B and B2C marketing concepts.

· Prior experience in social media management is an added advantage.

· Plan, execute, and manage WhatsApp marketing campaigns to engage prospects and customers.

· Knowledge of AI is also an added advantage and utilizing AI tools accordingly for content creation, chat automation, campaign optimization, and analytics.

Benefits:

Competitive salary
Professional development opportunities
Collaborative and vibrant work environment

Experience Required

· 1 – 2 Years (Fresher’s can apply)

Education:

Bachelor's (Preferred)

Language:

English (Required)