Hands-On Cybersecurity Training Expert Needed

Job Description – Cybersecurity Trainer / Offensive Security Expert

Position: Cybersecurity Trainer / Offensive Security Expert
Engagement Type: Freelance / Contract
Location: Mumbai – Onsite Only
Training Duration: 18 Days
Professional Fee: ₹50,000
Travel, Accommodation & Food: Provided separately for the trainer

We are looking for a highly experienced Cybersecurity Trainer / Offensive Security Professional to deliver an advanced, practical and hands-on cybersecurity training program onsite in Mumbai.

This is a strictly hands-on training requirement. The selected trainer must be capable of covering the complete scope mentioned below. Candidates who cannot deliver the complete training curriculum should not apply.

Mandatory Training Expertise

The trainer must have strong practical experience in:

MAC/DHCP attacks
ARP Poisoning and Spoofing
DNS Poisoning
Network Sniffing and Countermeasures
Wireshark-based traffic and attack analysis
IPv6 Attacks and Reconnaissance
DoS/DDoS and Botnet concepts
Session Hijacking
IDS/Firewall Evasion concepts
Honeypot concepts and bypass techniques
Wireless Security Testing
WPA2/WPA3 Security Testing
Evil Twin and Rogue Access Point attacks
Metasploit & Post-Exploitation

Strong hands-on expertise required in:

Metasploit Framework
Exploit Modules
Staged and Non-Staged Payloads
Meterpreter
Multi-handler
Client-side attack demonstrations
msfvenom
Vulnerability Research and Exploitation Concepts
Windows/Linux VM exploitation
Process Migration
Pivoting
Persistence
Advanced Payload and Transport Concepts
Controlled Payload Obfuscation and AV/EDR Evasion demonstrations
Active Directory & Privilege Escalation

The trainer must be capable of conducting advanced hands-on sessions covering:

Active Directory Enumeration
AD Authentication Attacks
AD Privilege Escalation
Lateral Movement
Persistence
Windows Privilege Escalation
UAC-related weaknesses
File and Service Permission Misconfigurations
Kernel Vulnerability concepts
Linux Privilege Escalation
Sudo Misconfigurations
SUID Exploitation
Writable Sensitive Files
Multi-machine Active Directory lab environments

Knowledge of C2 frameworks and related technologies including:

Cobalt Strike
Meterpreter
PowerShell Empire
Command & Control concepts
Web, Mobile, API & Thick Client Security

The trainer must have practical penetration testing experience across:

Web Applications
Android Applications
iOS Applications
REST APIs
SOAP APIs
GraphQL APIs
Thick Client Applications
Client-Side Security Testing
Authentication Testing
Authorization Testing
Session Management
IDOR / BOLA / BFLA
SQL / NoSQL / Command Injection
XSS
CSRF
SSRF
XXE
File Upload Vulnerabilities
Path Traversal
LFI / RFI
Insecure Deserialization
Business Logic Vulnerabilities
JWT Security
OAuth Security
API Authentication and Authorization
API Rate Limiting and Resource Abuse
Sensitive Data Exposure
Mobile Data Storage Security
Mobile Communication Security
SSL/TLS Testing
Certificate Pinning Testing
Mobile Reverse Engineering
Runtime Analysis
SSDLC, SAST & DAST

Trainer must have practical knowledge of:

Secure Software Development Lifecycle
SAST
SonarQube
DAST
Burp Suite
Automated and Manual Application Security Testing
Security Findings Analysis
Remediation Guidance
Secure Development Practices
Software Composition Analysis – SCA

Hands-on knowledge required in:

Software Composition Analysis
Open-Source Dependency Risk Assessment
Vulnerable Dependency Detection
Snyk
OWASP Dependency-Check
Dependency Vulnerability Assessment and Reporting
Threat Modelling

Trainer should be capable of covering:

Threat Modelling Concepts
Threat Modelling Methodologies
STRIDE or equivalent methodologies
Assets and Trust Boundaries
Data Flow Analysis
Attack Surface Identification
Threat Identification
Risk Prioritization
Mitigation Planning
Threat Modelling Reporting
Practical exercises using OWASP Threat Dragon
Cloud, Container & Kubernetes Security

Strong hands-on knowledge is mandatory in:

AWS Security
Microsoft Azure Security
GCP Security
Cloud Enumeration
Cloud Misconfiguration Identification
IAM Security
IAM Privilege Escalation
Exposed Cloud Storage
Exposed Access Keys and Credentials
Cloud Metadata Services
SSRF-to-Metadata attack scenarios
Docker Security
Container Security
Container Escape concepts
Kubernetes Enumeration
Kubernetes Misconfigurations
Kubernetes Privilege Escalation
Cloud Attack and Exploitation Labs
LLM / Generative AI Security Testing

Trainer must be familiar with practical LLM security testing including:

OWASP Top 10 for LLM Applications
Prompt Injection
Indirect Prompt Injection
Jailbreaking
Sensitive Information Disclosure
Model Abuse
Insecure Output Handling
Excessive Agency
LLM API Security
Authentication & Authorization Testing
Access Control Testing
Adversarial Prompt Engineering
Practical LLM Security Labs
Vulnerability Lifecycle & Reporting

Trainer must be capable of explaining and demonstrating the complete vulnerability lifecycle:

Identification → Validation → Reporting → Follow-up → Remediation → Retesting → Closure

Including:

Vulnerability Severity Assessment
Evidence Collection
Proof-of-Concept Preparation
Technical Reporting
Executive Reporting
Remediation Recommendations
Vulnerability Acceptance Criteria
Follow-up Procedures
Retesting
Closure Process
Hands-on Lab Experience

Trainer must have experience with multiple practical lab environments/platforms, preferably including:

OffSec Proving Grounds
PwnedLabs
PortSwigger Web Security Academy
OWASP Threat Dragon
Windows/Linux vulnerable machines
Active Directory Labs
Cloud Security Labs
Wireless Security Labs

Two external lab platforms will be used during the engagement.

Mandatory Candidate Requirements
Minimum 4+ years of practical Cybersecurity / Penetration Testing / Red Teaming experience preferred
Strong hands-on training delivery experience
Excellent knowledge of Network, Web, API, Mobile, AD, Cloud and Application Security
Strong Windows and Linux security knowledge
Ability to independently conduct practical demonstrations and labs
Strong understanding of cybersecurity tools and attack methodologies
Strong vulnerability reporting and remediation knowledge
Good communication and technical explanation skills
Must be comfortable delivering advanced technical training to cybersecurity professionals
Must be available for the complete 18-day onsite engagement in Mumbai
Must be capable of covering the complete curriculum mentioned in this JD
Preferred Certifications

Relevant hands-on certifications will be highly preferred, including:
OSCP or equivalent hands-on penetration testing expertise is highly preferred.

Commercial & Engagement Details

Location: Mumbai
Mode: 100% Onsite
Duration: 18 Days
Professional Fee: ₹50,000 for the engagement
Travel: Provided / Reimbursed separately
Accommodation: Provided
Food: Provided

The professional fee is separate from the approved travel, accommodation and food arrangements.

Only candidates who meet the technical requirements and are confident in delivering the complete hands-on curriculum should apply.