Risk Services Cybersecurity Senior Associate / Assistant Manager - Offensive Security

About the role

PwC is looking for an experienced offensive security professional to lead end-to-end Security Testing engagements (VAPT, HCR, SCR and similar) within its Risk and Security Controls practice. The role also contributes to business development, combining technical expertise in security assessments with project management and a commercial mindset.

Key responsibilities

• Manage Security Testing projects end-to-end: scoping, scheduling, resource allocation, execution, quality review, reporting and closure, while handling several concurrent projects and meeting SLAs and deadlines.
• Develop project plans, trackers and dashboards, run kick-offs, weekly reviews and debriefs, and coordinate with consultants, QA reviewers and the threat intelligence team.
• Identify project risks and delays early, escalate where needed, and ensure deliverables are quality reviewed before client submission.
• Improve delivery processes, templates, checklists and methodologies.
• Carry out vulnerability assessments and penetration testing (VAPT) across networks, web and mobile apps, APIs, cloud and infrastructure, and perform source code reviews when required.
• Run red team engagements by simulating adversary TTPs, and prepare detailed reports and presentations for technical and executive audiences.

Required profile

• Bachelor's degree in Computer Engineering/Science, Information Security or a related field (or equivalent experience).
• 3-5 years of offensive security / security testing experience, preferably in consulting or professional services.
• Proven track record managing multiple security testing projects with tight deadlines, and hands-on end-to-end delivery.
• Experience estimating effort, scoping and pricing security assessments.
• CERTIFIED CREST CRT (required); CREST CCT, GPEN, GWAPT, OSWE, OSED, CRTO, CRTP, OSCP, CEH and PMP/PRINCE2 are preferred.

Required skills

• Penetration testing across networks, web apps, APIs, mobile and cloud, with wireless, web and network security credentials.
• Red team infrastructure setup and shell scripting or automation (Python, Perl, Bash, Ruby, PowerShell).
• Familiarity with cloud security assessments (AWS, Azure, GCP) and compliance-driven VAPT (PCI-DSS, ISO 27001, NIST, SOC 2, HIPAA).
• Strong stakeholder management, clear communication and project management skills.