Penetration Tester – Cloud, Data & Agentic AI (Dubai)

PENETRATION TESTER – CLOUD, DATA & AGENTIC AI

Location: XenonStack Software Limited, DIFC, Dubai, UAE | Work from Office

Experience: 5–10 years | Employment: Full-time, XenonStack Software Limited | Team: Cybersecurity / Security Assurance / Agentic AI Security

Role Level: Experienced Individual Contributor

About Xenonstack

XenonStack is a Data and AI Foundry for Agentic Systems, enabling enterprises to design, deploy, operate, and scale intelligent agents across digital and physical environments.

We Build Enterprise-grade Platforms Across The Agentic Stack

• Akira AI – Reasoning and agent orchestration.
• ElixirData – Context OS for enterprise data intelligence, knowledge graphs, contextual retrieval, and governed analytics.
• NexaStack – Agentic infrastructure automation. Secure, compliant AI deployment across cloud, edge, and on-premises environments.
• MetaSecure – Trust, compliance, and defense. Continuous assurance with AI-BOMs, risk scoring, and agentic security.
  
  

Our mission is to accelerate the world's transition to AI + Human Intelligence by making agentic systems reliable, responsible, and enterprise-ready.

About The Role

We are looking for a Penetration Tester – Cloud, Data & Agentic AI with 5–10 years of hands-on experience in application security, API penetration testing, cloud infrastructure, Kubernetes, and enterprise security assessments.

The candidate must possess a DESC Cyber Force-recognized penetration-testing qualification at Team Member level, with verifiable Cyber Force program experience or recognition and eligibility for registration under an approved provider.

You will perform hands-on penetration testing and security validation for enterprise and Dubai government customers, including environments where data confidentiality, system availability, regulatory compliance, and security assurance are critical.

The Platforms Under Assessment Include

• Enterprise Data Lakehouse and Analytics platforms.
• Context OS, knowledge graphs, vector databases, and AI-powered retrieval.
• Agentic AI platforms, multi-agent orchestration, and AgentOps solutions.
• Agentic Governance, Risk, and Compliance (GRC) platforms.
• Cloud-native applications, APIs, containers, Kubernetes, and identity systems.
  
  

You will identify and validate security vulnerabilities, demonstrate realistic attack scenarios, document security findings, verify remediations, and prepare penetration-testing reports suitable for customer security reviews.

This is a hands-on technical security role, not a security management, compliance-only, or automated vulnerability-scanning position.

ROLE MISSION

Ensure enterprise cloud, data, analytics, and Agentic AI platforms are thoroughly assessed for exploitable security vulnerabilities through hands-on penetration testing, with reproducible findings, actionable remediation recommendations, and reliable security evidence.

Key Responsibilities

• Penetration Testing & Security Assessment
• Execute authorized penetration-testing engagements across enterprise applications, APIs, networks, and cloud infrastructure.
• Perform black-box, grey-box, and white-box penetration testing using recognized methodologies.
• Identify and validate authentication bypasses, authorization weaknesses, privilege escalation, injection vulnerabilities, insecure configurations, and sensitive data exposure.
• Conduct authenticated and unauthenticated API penetration testing aligned with OWASP API Security Top 10.
• Test OAuth 2.0, OpenID Connect, JWT, RBAC, ABAC, and service-to-service authentication and authorization.
• Validate multi-tenant isolation and cross-tenant data-access controls.
• Develop controlled, non-destructive proof-of-concept exploits to demonstrate realistic attack paths and business impact.
• Perform manual security testing beyond automated vulnerability-scanning results.
• Cloud & Kubernetes Security
• Perform penetration testing of Microsoft Azure and approved private-cloud environments.
• Assess Kubernetes clusters, container workloads, API gateways, ingress controllers, and network segmentation.
• Identify insecure IAM permissions, workload identity weaknesses, exposed secrets, and container security risks.
• Validate private networking, restricted egress, secrets management, and boundaries between staging and production.
• Assess CI/CD pipelines, deployment credentials, container registries, and software supply-chain risks.
• Data Lakehouse & Analytics Security
• Assess data ingestion pipelines, storage layers, query engines, and analytics services.
• Evaluate security controls across Spark-based processing, Apache Iceberg, Trino, object storage, and related data-platform components.
• Test data-access permissions, service credentials, API integrations, and access to sensitive datasets.
• Identify potential sensitive-information exposure, unauthorized data extraction, and access-control weaknesses.
• Validate encryption, data segregation, auditability, and secure data movement between platform components.
• Assess whether analytics services and AI workloads can bypass underlying data-access policies.
• Agentic AI, LLM & Context OS Security
• Perform adversarial security testing of LLM-powered applications, AI agents, and multi-agent workflows.
• Assess direct and indirect prompt injection, tool-output manipulation, sensitive-information disclosure, and unauthorized agent actions.
• Test MCP servers, tool integrations, agent gateways, and agent-to-agent communication.
• Identify tool-permission escalation, confused-deputy vulnerabilities, and unsafe agent execution paths.
• Validate agent authentication, authorization, sandboxing, approval workflows, and runtime security boundaries.
• Assess RAG pipelines, knowledge retrieval, vector databases, and ContextGraph access controls.
• Evaluate whether malicious retrieved content can influence agent behavior or cause unauthorized access to enterprise systems.
• Agentic GRC & AgentOps Security
• Test agent discovery and inventory controls for identifying authorized and unauthorized AI agents.
• Validate shadow-agent detection mechanisms and potential inventory-evasion scenarios.
• Assess excessive permissions, permission inheritance, dormant access, and unauthorized tool execution.
• Test agent identity lifecycle, delegated access, and least-privilege enforcement.
• Validate approval gates for sensitive or privileged agent actions.
• Test policy-enforcement failures, audit-trail integrity, and agent activity monitoring.
• Identify potential bypasses in agent governance and runtime security controls.
• Assess security isolation between agent execution, monitoring, governance, and operational control planes.
• DESC Cyber Force & Security Compliance
• Perform penetration-testing activities in accordance with applicable DESC Cyber Force program requirements.
• Maintain the individual qualifications and records necessary for registration with an approved Cyber Force service provider.
• Follow CREST-aligned penetration-testing practices and customer-approved assessment methodologies.
• Prepare technical penetration-testing reports, vulnerability findings, supporting evidence, and remediation recommendations.
• Maintain reproducible evidence of vulnerabilities, affected assets, exploitability, and business impact.
• Support applicable DESC Information Security Regulation (ISR 3.1) control mapping and customer security assessments.
• Work with customer Information Security, Security Operations, and engineering teams to clarify security findings.
• Follow approved reporting, escalation, confidentiality, and evidence-handling procedures.
• Perform testing only within authorized scope and agreed Rules of Engagement.
• Vulnerability Remediation & Security Validation
• Classify vulnerabilities using CVSS and contextual business-risk assessment.
• Work with engineering and infrastructure teams to explain findings and remediation approaches.
• Independently retest vulnerabilities after security fixes are implemented.
• Verify that remediation closes the original attack path without introducing new security weaknesses.
• Maintain evidence-based remediation status and residual-risk documentation.
• Support formal security assessment closure and customer review processes.
  
  

How We Work With Ai

AI is part of the daily workflow at XenonStack, not an add-on.

• At our Dubai office, approved AI tools may be used for security research, code analysis, threat modeling, test planning, and documentation.
• Client systems, configurations, credentials, sensitive information, source code, and assessment evidence must never be exposed to unapproved external AI services.
• AI-generated security findings, exploitation approaches, and recommendations must be independently reviewed and technically validated.
• AI-assisted penetration testing must remain within explicitly authorized scope and approved Rules of Engagement.
• Production and critical operational systems require safeguards to prevent disruption, accidental data modification, or unauthorized information disclosure.
• Come ready to explain how you use AI responsibly to improve penetration-testing effectiveness without compromising evidence quality or customer confidentiality.
  
  

What Success Looks Like

• All assigned penetration-testing activities are completed within approved scope and assessment timelines.
• Security vulnerabilities are identified through effective manual and automated testing.
• All formal assessment reports meet applicable Cyber Force and customer reporting requirements.
• Every reported vulnerability includes reproducible technical evidence, business impact, and actionable remediation guidance.
• Critical and High vulnerabilities are accurately validated, prioritized, and tracked through remediation or authorized risk acceptance.
• All assigned remediation retests are completed with documented verification results.
• No penetration-testing activity causes avoidable disruption to critical customer services.
• Zero unauthorized exposure of customer data, credentials, or confidential assessment evidence.
• Cloud, API, data lakehouse, and Agentic AI security risks are covered through documented, risk-based testing scenarios.
• Security findings are clearly communicated to engineering and customer security stakeholders.
  
  

Must-have Skills

• Certification: OSCP preferred; CREST CRT, GPEN, GWAPT or another DESC Cyber Force-approved Penetration Testing Team Member certification accepted.
• Application & API penetration testing: Strong practical expertise in OWASP Top 10, OWASP API Security Top 10, authentication and authorization testing, business-logic vulnerabilities, and API abuse.
• Cloud & Kubernetes security: Hands-on experience testing Azure environments, Kubernetes deployments, containers, IAM, networking, and secrets management.
• Penetration-testing tools: Strong proficiency with Burp Suite Professional, Nmap, Metasploit, Nuclei, Wireshark, and related security-assessment tools.
• Identity & access security: Experience testing OAuth 2.0, OIDC, JWT, RBAC, ABAC, service accounts, privileged identities, and multi-tenant authorization.
• Data-platform security: Understanding of enterprise data architectures, SQL security, data-access controls, ingestion pipelines, object storage, and analytics systems.
• AI & Agentic security: Practical understanding of LLM applications, prompt injection, RAG, AI agents, MCP tool integrations, agent permissions, and emerging AI security attack patterns.
• Security assessment methodology: Experience with CREST-aligned testing, OWASP Web Security Testing Guide, PTES, and risk-based penetration-testing practices.
• Compliance & reporting: Familiarity with DESC requirements, Dubai government security standards, CVSS, evidence handling, and formal VAPT reporting.
• Technical scripting: Ability to use Python, Bash, or equivalent languages for security testing, automation, and proof-of-concept development.
• Technical communication: Ability to explain security vulnerabilities, demonstrate their impact, and provide actionable remediation guidance to engineering and customer security teams.
  
  

Good-to-have Skills

• Previous penetration-testing engagements for Dubai government, semi-government, healthcare, or critical infrastructure organizations.
• Experience working with DESC Cyber Force-certified penetration-testing service providers.
• Advanced certifications such as OSEP, OSWE, CREST CCT APP, CREST CCT INF, or GXPN.
• Security testing experience with Microsoft Azure, Azure OpenAI, private cloud, and UAE-hosted AI infrastructure.
• Hands-on experience with Apache Spark, Apache Iceberg, Trino, MinIO, or equivalent enterprise data platforms.
• Kubernetes and container security tools such as Trivy, kube-bench, Falco, or equivalent technologies.
• Familiarity with OWASP LLM and Agentic AI security guidance and MITRE ATLAS.
• Experience testing identity and authorization enforcement for AI agents and MCP servers.
• Understanding of agent governance, shadow AI, excessive permissions detection, AI-BOMs, and runtime policy enforcement.
• Experience with SIEM, SOC operations, security telemetry, and vulnerability management platforms.
• Experience validating security controls in isolated or restricted-egress environments.
• Familiarity with ISO/IEC 27001, NIST security standards, and healthcare information-security requirements.
• Experience with source-code-assisted penetration testing and secure SDLC practices.
  
  

CANDIDATE PROFILE

• 5–10 years of hands-on experience in penetration testing, offensive security, application security, or related cybersecurity roles.
• Proven experience performing manual penetration testing and validating exploitable vulnerabilities.
• Holds at least one DESC Cyber Force-approved Team Member certification for penetration testing.
• Has verifiable Cyber Force program experience or recognition and meets the prerequisites for registration under an approved service provider.
• Eligible to obtain and maintain applicable Dubai Police clearance and customer-required background verification.
• Practical experience assessing cloud-native platforms, APIs, identity systems, and enterprise applications.
• Understanding of modern AI security threats, data-platform vulnerabilities, and cloud security architecture.
• Experience preparing formal VAPT reports for enterprise, regulated, or government customers.
• Ability to manage sensitive customer data and security evidence with strict confidentiality.
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related field; equivalent demonstrated experience will be considered.
• Strong analytical thinking, problem-solving, technical documentation, and communication skills.
• Comfortable working from the XenonStack office in DIFC, Dubai, and attending customer-site assessments as required.
  
  

We value penetration testers who can identify exploitable vulnerabilities, demonstrate realistic attack paths, explain their impact, and verify remediation—not simply generate automated vulnerability-scanner reports.

Be ready to demonstrate how you identified an authentication or authorization bypass, performed API penetration testing, validated cloud misconfigurations, documented security findings, and verified that a vulnerability was effectively remediated.

Hands-on penetration-testing experience is essential. Security compliance, vulnerability scanning, or audit experience alone is not sufficient for this role.

HIRING PROCESS

Pre-screening assessment (approximately 12 minutes, at application) → Cyber Force certification and eligibility verification → Technical interview → Practical hands-on penetration-testing assessment → Face-to-face technical interview at the XenonStack DIFC office → HR and Leadership round → Background verification and applicable security-clearance checks → Offer.

TERMS

• Location: Work from XenonStack Software Limited, DIFC, Dubai, UAE.
• Full-time, work-from-office position.
• Customer-site visits within Dubai or the UAE may be required.
• Immediate joiners or candidates with short notice periods preferred.
• DESC Cyber Force Team Member qualification is mandatory.
• Continued eligibility for applicable Cyber Force recognition, professional certifications, and security clearance is required.
• Background verification is mandatory.
• Testing activities are subject to customer authorization, approved scope, and applicable regulatory requirements.
• Compensation as per company policy, UAE employment terms, and approved budget band.
  
  

How We Work

We value deep work, clarity, and execution over activity. You will be expected to clarify, plan, execute, and escalate with options, not wait to be told.

Ownership sits with the individual, and outcomes are measured, not effort.

Security findings must be backed by evidence, remediation must be independently verified, and customer trust must never be compromised.

OUR VALUES

Agency – Be self-directed and proactive | Taste – Sweat the details and build with precision | Ownership – Take responsibility for outcomes | Mastery – Commit to continuous learning and growth | Impatience – Move fast and challenge inertia | Customer Obsession – Always put the customer first

WHY JOIN US

• Perform hands-on penetration testing for enterprise and government-sector platforms in Dubai.
• Work at the intersection of cybersecurity, cloud infrastructure, enterprise data platforms, and Agentic AI.
• Assess emerging AI security risks, including unauthorized agents, excessive permissions, unsafe tool execution, and autonomous workflows.
• Collaborate with platform engineering, AgentOps, SRE, governance, and customer security teams.
• Gain exposure to advanced Context OS, data lakehouse, AI orchestration, and security-governance technologies.
• Work in an AI-first engineering environment using approved AI capabilities to improve the depth and efficiency of security assessments.
• Contribute to the security and trustworthiness of enterprise AI platforms deployed in regulated environments.
• Be part of a Great Place to Work-Certified organization with 14+ years of experience and headquarters in Mohali, India.