Hands-On Cybersecurity Training Expert Needed

Job Description – Cybersecurity Trainer / Offensive Security Expert Position: Cybersecurity Trainer / Offensive Security Expert Engagement Type: Freelance / Contract Location: Mumbai – Onsite Only Training Duration: 18 Days Professional Fee: ₹50,000 Travel, Accommodation & Food: Provided separately for the trainer We are looking for a highly experienced Cybersecurity Trainer / Offensive Security Professional to deliver an advanced, practical and hands-on cybersecurity training program onsite in Mumbai. This is a strictly hands-on training requirement. The selected trainer must be capable of covering the complete scope mentioned below. Candidates who cannot deliver the complete training curriculum should not apply. Mandatory Training Expertise The trainer must have strong practical experience in: MAC/DHCP attacks ARP Poisoning and Spoofing DNS Poisoning Network Sniffing and Countermeasures Wireshark-based traffic and attack analysis IPv6 Attacks and Reconnaissance DoS/DDoS and Botnet concepts Session Hijacking IDS/Firewall Evasion concepts Honeypot concepts and bypass techniques Wireless Security Testing WPA2/WPA3 Security Testing Evil Twin and Rogue Access Point attacks Metasploit & Post-Exploitation Strong hands-on expertise required in: Metasploit Framework Exploit Modules Staged and Non-Staged Payloads Meterpreter Multi-handler Client-side attack demonstrations msfvenom Vulnerability Research and Exploitation Concepts Windows/Linux VM exploitation Process Migration Pivoting Persistence Advanced Payload and Transport Concepts Controlled Payload Obfuscation and AV/EDR Evasion demonstrations Active Directory & Privilege Escalation The trainer must be capable of conducting advanced hands-on sessions covering: Active Directory Enumeration AD Authentication Attacks AD Privilege Escalation Lateral Movement Persistence Windows Privilege Escalation UAC-related weaknesses File and Service Permission Misconfigurations Kernel Vulnerability concepts Linux Privilege Escalation Sudo Misconfigurations SUID Exploitation Writable Sensitive Files Multi-machine Active Directory lab environments Knowledge of C2 frameworks and related technologies including: Cobalt Strike Meterpreter PowerShell Empire Command & Control concepts Web, Mobile, API & Thick Client Security The trainer must have practical penetration testing experience across: Web Applications Android Applications iOS Applications REST APIs SOAP APIs GraphQL APIs Thick Client Applications Client-Side Security Testing Authentication Testing Authorization Testing Session Management IDOR / BOLA / BFLA SQL / NoSQL / Command Injection XSS CSRF SSRF XXE File Upload Vulnerabilities Path Traversal LFI / RFI Insecure Deserialization Business Logic Vulnerabilities JWT Security OAuth Security API Authentication and Authorization API Rate Limiting and Resource Abuse Sensitive Data Exposure Mobile Data Storage Security Mobile Communication Security SSL/TLS Testing Certificate Pinning Testing Mobile Reverse Engineering Runtime Analysis SSDLC, SAST & DAST Trainer must have practical knowledge of: Secure Software Development Lifecycle SAST SonarQube DAST Burp Suite Automated and Manual Application Security Testing Security Findings Analysis Remediation Guidance Secure Development Practices Software Composition Analysis – SCA Hands-on knowledge required in: Software Composition Analysis Open-Source Dependency Risk Assessment Vulnerable Dependency Detection Snyk OWASP Dependency-Check Dependency Vulnerability Assessment and Reporting Threat Modelling Trainer should be capable of covering: Threat Modelling Concepts Threat Modelling Methodologies STRIDE or equivalent methodologies Assets and Trust Boundaries Data Flow Analysis Attack Surface Identification Threat Identification Risk Prioritization Mitigation Planning Threat Modelling Reporting Practical exercises using OWASP Threat Dragon Cloud, Container & Kubernetes Security Strong hands-on knowledge is mandatory in: AWS Security Microsoft Azure Security GCP Security Cloud Enumeration Cloud Misconfiguration Identification IAM Security IAM Privilege Escalation Exposed Cloud Storage Exposed Access Keys and Credentials Cloud Metadata Services SSRF-to-Metadata attack scenarios Docker Security Container Security Container Escape concepts Kubernetes Enumeration Kubernetes Misconfigurations Kubernetes Privilege Escalation Cloud Attack and Exploitation Labs LLM / Generative AI Security Testing Trainer must be familiar with practical LLM security testing including: OWASP Top 10 for LLM Applications Prompt Injection Indirect Prompt Injection Jailbreaking Sensitive Information Disclosure Model Abuse Insecure Output Handling Excessive Agency LLM API Security Authentication & Authorization Testing Access Control Testing Adversarial Prompt Engineering Practical LLM Security Labs Vulnerability Lifecycle & Reporting Trainer must be capable of explaining and demonstrating the complete vulnerability lifecycle: Identification → Validation → Reporting → Follow-up → Remediation → Retesting → Closure Including: Vulnerability Severity Assessment Evidence Collection Proof-of-Concept Preparation Technical Reporting Executive Reporting Remediation Recommendations Vulnerability Acceptance Criteria Follow-up Procedures Retesting Closure Process Hands-on Lab Experience Trainer must have experience with multiple practical lab environments/platforms, preferably including: OffSec Proving Grounds PwnedLabs PortSwigger Web Security Academy OWASP Threat Dragon Windows/Linux vulnerable machines Active Directory Labs Cloud Security Labs Wireless Security Labs Two external lab platforms will be used during the engagement. Mandatory Candidate Requirements Minimum 4+ years of practical Cybersecurity / Penetration Testing / Red Teaming experience preferred Strong hands-on training delivery experience Excellent knowledge of Network, Web, API, Mobile, AD, Cloud and Application Security Strong Windows and Linux security knowledge Ability to independently c