Cybersecurity Senior Associate / Assistant Manager - Offensive Security

About the role

PwC is looking for an experienced offensive security professional to lead end-to-end Security Testing engagements (VAPT, HCR, SCR and similar) while also contributing to business development. The role sits in the Risk and Security Controls practice, which helps organisations strengthen the security posture of their IT systems. Candidates combine technical expertise in security assessments with project management skills and a commercial mindset.

Key responsibilities

• Own and manage Security Testing engagements from scoping, scheduling, resource allocation, execution, quality review, reporting to closure, within strict deadlines
• Manage multiple concurrent projects, keeping to SLAs, timelines and quality benchmarks
• Maintain project plans, trackers and status dashboards, and coordinate with consultants, QA reviewers and threat intelligence teams
• Run kick-off calls, weekly status reviews and post-engagement debriefs with clients, and escalate risks and delays
• Ensure deliverables are quality reviewed before client submission, and improve delivery processes, templates and checklists
• Carry out vulnerability assessments and penetration testing (VAPT) across networks, web and mobile apps, APIs, cloud and infrastructure, and run red team engagements where required
• Perform source code reviews when needed, and prepare detailed reports and presentations for technical and executive audiences
• Interface with clients on issues and escalations, and stay up to date on threats and industry trends

Required profile

• Bachelor's degree in Computer Engineering/Science, Information Security or a related field (or equivalent experience)
• 3-5 years of offensive security / security testing experience, preferably in consulting or professional services
• Proven track record managing multiple security testing projects with tight deadlines
• Experience with effort estimation, scoping and pricing of security assessments
• CREST CRT certification (required); OSCP, GPEN, GWAPT, OSWE, OSED, CRTO, CRTP, CEH, PMP or PRINCE2 preferred
• Work visa sponsorship available

Required skills

• Penetration testing across networks, web apps, APIs, mobile and cloud
• Wireless, web application and network security testing
• Red team infrastructure setup and operation
• Shell scripting or automation with Python, Perl, Bash, Ruby or PowerShell
• Cloud security assessments (AWS, Azure, GCP) and compliance-driven VAPT (PCI-DSS, ISO 27001, NIST, SOC 2, HIPAA)
• Project management and client-facing communication