Penetration Tester

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct penetration testing engagements for external networks, web applications, and APIs, adhering to established scopes, methodologies, and rules of engagement.

• Detect, validate, and manually exploit vulnerabilities using public exploits, custom-developed techniques, or a combination of both.

• Assess attack paths and evaluate the potential business and technical implications of identified vulnerabilities.

• Prepare clear, precise, and defensible reports for clients that detail findings, associated risks, evidence, and remediation suggestions.

• Engage with clients throughout the testing process, including technical discussions, walkthroughs of findings, and addressing any questions or challenges that arise.

• Manage assigned projects with minimal supervision while ensuring high standards of quality, professionalism, and meticulous attention to detail.

• Collaborate with colleagues to assess offensive security tools and enhance testing methodologies, delivery processes, and reporting standards.

• Provide technical knowledge and practical insights to less-experienced team members and clients when suitable.

• Stay updated on the latest vulnerabilities, attack methodologies, security research, and industry trends.

• Report directly to the Director of Web Application & External Offensive Operations.

⛳️ Requirements

• Master’s or Bachelor’s degree in cybersecurity, management information systems, computer science, or a related field.

• 2-5 years of practical experience in penetration testing, with a focus on at least one of the following: External Penetration Tests, Web Application Penetration Tests, API Penetration Tests, or Mobile Application Penetration Tests.

• Proven ability to independently conduct penetration testing engagements and produce high-quality deliverables for clients.

• Familiarity with recognized penetration testing methodologies and disciplined practices for evidence collection.

• Experience in identifying and manually validating exploitable vulnerabilities, rather than relying solely on automated tools.

• Ability to communicate technical findings, risks, and remediation guidance effectively to clients and internal stakeholders.

• Proficient in commonly used offensive security tools such as Nmap, SQLmap, Burp Suite, Postman, Nuclei, Wireshark, Nessus, and Caido.

• Skilled in one or more scripting languages including Python, Bash, JavaScript, PowerShell, or SQL.

• Strong understanding of web technologies, networking concepts, authentication, access control, and prevalent application security vulnerabilities.

• Capacity to work both independently and collaboratively in a remote, fast-paced environment.

• Excellent written and verbal communication skills, with the ability to articulate technical issues to diverse audiences.

• Capability to meet deadlines while maintaining a high level of motivation, self-discipline, and quality of work.

• Preferred certifications include OSCP, eWPT, eWPTX, OSWA, or OSWE.

🏝️ Benefits

• Healthcare, Dental, and Vision Benefits.

• Employer Paid Life Insurance and Disability Insurance.

• Employee Assistance Program (EAP).

• Pet Insurance.

• 401(k) Plan with Employer Matching.

• Competitive Bonus Structure.

• Tech Allowance.

• Certification Reimbursement.

• Personalized Career Coaching.

• Generous Paid Time Off.

• Paid Office Closure from December 25 to January 1.

• Vacation Bonus.

• Summer Hours.