Penetration Tester

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct external network, web application, and API penetration testing assignments.

• Identify, validate, and manually exploit vulnerabilities utilizing public exploits, custom-developed exploits, or a mix of techniques.

• Assess findings within context, formulate realistic attack paths, and evaluate business and technical risks.

• Produce clear, precise, and client-ready reports detailing findings, risk ratings, evidence, and actionable remediation guidance.

• Effectively communicate technical matters, testing outcomes, and remediation suggestions to client stakeholders.

• Ensure project quality and timelines are maintained with minimal supervision.

• Collaborate with the offensive security team to assess tools, enhance delivery methods, and share technical expertise.

• Mentor junior testers and contribute to team capabilities and repeatable testing methodologies.

• Report directly to the Director of Web Application & External Offensive Operations.

⛳️ Requirements

• Bachelor's degree in cybersecurity, computer science, a related field, or equivalent professional experience.

• Over 5 years of practical offensive security experience, with at least 3 years dedicated to external network, web application, or API penetration testing.

• Experience in performing web application penetration testing using black-box, grey-box, and white-box methodologies.

• Familiarity with testing APIs, including REST, GraphQL, SOAP, or gRPC.

• Demonstrated ability to manage engagements from scoping and execution to reporting and client debriefs.

• Solid understanding of OWASP WSTG, OWASP ASVS, OWASP API Security Top 10, and PTES.

• Must possess at least one of the following: OSCP/OSCP+, OSWA, eWPT, HTB CWES, TCM PWPP, GWAPT, GPEN, or CREST CRT.

• Advanced skills in manual testing and web exploitation.

• Knowledge of external attack surfaces, OSINT, asset discovery, edge-device exploitation, and SSO or MFA attack techniques.

• Proficiency in Python, Bash, JavaScript, PowerShell, or Go.

• Familiarity with tools such as Burp Suite, Caido, Nmap, Nuclei, SQLmap, ffuf, Postman, and Nessus.

• Experience with frameworks including Laravel, Express.js, ASP.NET Core, Spring, and Django.

• Capability to produce clear, concise, client-ready reports with accurate risk assessments and actionable remediation advice.

• Exceptional verbal and written communication skills.

• Ability to work both independently and collaboratively in a dynamic, remote environment while meeting deadlines.

• Published CVEs, conference presentations, or significant contributions to open-source security tools may be considered in lieu of certifications.

• Prior consulting or client-facing security delivery experience is preferred.

• Experience in mobile application penetration testing for iOS or Android is preferred.

• Preferred experience in white-box or source-code-assisted testing.

• Familiarity with assessing AI or LLM-integrated applications is preferred.

• Knowledge of OWASP Top 10 for LLM Applications and cloud attack surfaces across AWS, Azure, or GCP is preferred.

🏝️ Benefits

• Comprehensive Healthcare, Dental, and Vision Benefits.

• Employer Paid Life Insurance and Disability Insurance.

• Employee Assistance Program (EAP).

• Pet Insurance.

• 401(k) Plan with Employer Matching.

• Competitive Bonus Structure.

• Technology Allowance.

• Certification Reimbursement.

• Personalized Career Coaching.

• Generous Paid Time Off.

• Paid Office Closure from December 25 to January 1.

• Vacation Bonus.

• Summer Hours.