Offensive Security Developer (intern)

Apply at: https://pivotsec.in/careers/
Why P.I.V.O.T Security?
P.I.V.O.T Security Private Limited is a New Delhi-based offensive cybersecurity company. We think like attackers so our clients can defend like professionals. Our work spans red teaming, adversary simulation, penetration testing, digital forensics and incident response (DFIR), AI and LLM security assessment, and governance programs such as ISMS implementation. We are a product company as much as a services company. Our engineering team builds and ships our own security platforms, and our services teams use those platforms on live engagements. That loop between building and breaking shapes how we work. Our researchers have disclosed vulnerabilities to the Microsoft Security Response Center (MSRC) and presented research at international & national forums.
About the role
We are looking for an Offensive Security Developer Intern who writes production-quality code and wants to apply it to offensive security. You will join our product engineering team and work hands-on on STEP, our BAS platform, and WARUS, our agentic DAST and SAST platform, along with other offensive tooling as priorities evolve.
This is a developer role first. You will design, build, test and ship software that our security teams and clients use. You will also work alongside our red team and DFIR practitioners, so you see how the tools you build perform against real environments.
Key Responsibilities
BAS platform development: Build and improve attack simulation modules, agents, orchestration logic, result collection and reporting, mapped to frameworks such as MITRE ATT&CK
Agentic DAST and SAST: Develop and refine AI-driven agents that discover, test and validate vulnerabilities in web applications, APIs and source code
New capabilities: Prototype and harden new offensive security features as the product roadmap requires
Engineering practice: Write clean, modular, tested and documented code; follow version control discipline and take part in code reviews
Secure development: Apply secure coding practices to everything you build. Security tooling must itself be secure
Testing and validation: Build lab environments, write test cases and verify that features work reliably before release
Engagement exposure: Support red team, adversary simulation and DFIR activities under supervision when assigned
Documentation: Maintain internal technical documentation for the components you own
Requirements
Strong programming ability in Python and/or Go. Working knowledge of JavaScript or TypeScript is a plus
Solid grasp of coding practices: modular design, testing, debugging, Git workflows and code review
Understanding of web application and API security, including the OWASP Top 10 and OWASP API Security Top 10
Working knowledge of Linux, networking fundamentals (TCP/IP, HTTP, DNS) and Windows basics
Familiarity with Docker, REST APIs and databases
B.Tech, B.E., BCA, MCA or M.Tech in Computer Science, IT or a related field (final-year students and recent graduates may apply)
Demonstrable coding ability through personal projects, coursework or prior work
Willingness to work fully onsite in New Delhi and commit to a long-term engagement
Good to Have
• Experience with LLM APIs, agent frameworks or tool-calling workflows.
• Exposure to static analysis, dynamic scanning or fuzzing tools.
• Knowledge of MITRE ATT&CK, Active Directory attacks or post-exploitation concepts.
• CTF participation, responsible vulnerability disclosures or open source contributions.
• Entry-level offensive security certifications.
What You Will Learn
This internship is built for people who want to learn fast and go deep. You will not sit in a sandbox. You will learn on the same products and engagements our full-time team works on.
• Product engineering: How a security product moves from design to release: architecture decisions, secure SDLC, code review culture, testing and release discipline.
• Attack simulation engineering: How real attacker techniques are researched, modelled safely and turned into repeatable simulations mapped to MITRE ATT&CK.
• AI application security: How LLM agents, tool calling and orchestration work in practice, how to use AI for vulnerability discovery, and how AI systems themselves get attacked.
• Red teaming and adversary simulation: How engagements are scoped, run and reported for regulated clients, through direct exposure to live work.
• Digital forensics and incident response: How incidents such as ransomware attacks are triaged, investigated and contained, and what attackers leave behind.
• Client delivery: How technical findings become clear, defensible reports for banks, government departments and critical-sector clients.
• Research discipline: How vulnerability research and responsible disclosure work inside legal and contractual boundaries.

Work arrangement
No