Mid-Level Penetration Tester

This is a fully remote position, open to applicants in Texas.

📋 Description

• Conduct penetration testing engagements independently on web applications, networks, APIs, mobile applications, wireless environments, and cloud-hosted systems utilizing both black-box and white-box methodologies.

• Execute testing procedures aligned with NIST, OWASP, PTES, and other industry-standard security assessment frameworks.

• Develop attack paths, verify vulnerabilities, and demonstrate exploitability while adhering to engagement objectives and timelines.

• Oversee assigned engagements from the planning and scoping phase through execution, reporting, and customer debriefs.

• Collaborate with senior team members, project managers, and clients to ensure the successful delivery of assessments.

• Provide technical mentorship and guidance to junior team members as appropriate.

• Create detailed technical reports that communicate vulnerabilities, business implications, attack scenarios, and recommendations for remediation.

• Present findings to technical teams, management, and executive stakeholders.

• Assist clients in prioritizing risks and formulating remediation strategies.

• Carry out web application assessments using OWASP WSTG and OWASP Top 10 methodologies.

• Conduct API security evaluations involving REST, GraphQL, SOAP, and contemporary authentication methods.

• Perform mobile application security testing on iOS and Android platforms.

• Engage in source code reviews and secure code assessments.

• Utilize a variety of commercial, government, open-source, and custom security tools.

• Develop and maintain scripts, utilities, and testing methodologies.

• Assess emerging attack techniques, vulnerabilities, and security technologies.

• Communicate technical findings effectively in both technical and business-oriented language.

• Present assessment results and remediation recommendations during client briefings and readouts.

• Foster and maintain positive relationships with customers.

• Stay updated on evolving threats, offensive security methodologies, vulnerabilities, and best practices.

• Contribute to research, enhancements of methodologies, tool development, and knowledge-sharing initiatives.

• Support cybersecurity capability enhancement in alignment with the NICE Cybersecurity Workforce Framework.

⛳️ Requirements

• A Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline; equivalency through relevant experience will be considered.

• Capability to successfully clear a CJIS Criminal Justice background check and maintain CJIS eligibility throughout employment.

• One or more industry-recognized penetration testing certifications are preferred, such as OSCP, GWAPT, PNPT, GPEN, OSEP, OSWE, PenTest+, and eJPT/eCPPT.

• A minimum of 5 years of practical experience in cybersecurity, including at least 2 years focused on penetration testing or offensive security assessments.

• In-depth knowledge of web application security testing methodologies, including OWASP WSTG and OWASP Top 10.

• Experience in conducting both authenticated and unauthenticated network penetration tests.

• Proficiency in using tools such as Burp Suite Professional, Nmap, Nessus/Tenable, Metasploit, and comparable platforms.

• Experience in identifying, exploiting, validating, and documenting security vulnerabilities.

• Familiarity with network protocols, operating systems, Active Directory, authentication mechanisms, and common enterprise architectures.

• Experience in drafting professional technical reports and presenting findings to both technical and non-technical audiences.

• Knowledge of MITRE ATT&CK, NIST, and PTES frameworks.

• Strong analytical, troubleshooting, and problem-solving abilities.

• Preferred: experience in mobile application security assessments using tools like Frida, Objection, MobSF, and ADB.

• Preferred: expertise in API, cloud environments (Azure, AWS, GCP), and containerized application assessments.

• Preferred: experience with source code review in languages such as Java, C#, Python, JavaScript, or Go.

• Preferred: experience in red team operations, adversary emulation, attack path analysis, scripting or automation, cloud security architectures, digital forensics, malware analysis, reverse engineering, mentoring, security research, bug bounty programs, Capture-the-Flag competitions, or public vulnerability disclosures.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Retirement savings plan with employer matching.

• Opportunities for professional development and certification support.

• Flexible work hours and remote work options.

• A collaborative and innovative work environment.