Penetration Tester

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Design and execute penetration tests on web applications, APIs, and mobile applications utilizing black-box, grey-box, and white-box methodologies.

• Identify and safely exploit vulnerabilities such as injection flaws, broken authentication and access control issues, business logic weaknesses, and insecure configurations.

• Conduct manual testing in conjunction with automated scanning and validate results to eliminate false positives.

• Produce clear and precise reports that include risk assessments, proof of concept, business implications, and actionable remediation steps.

• Deliver findings to both technical and non-technical stakeholders.

• Conduct retests of fixes to ensure issues have been resolved.

• Align findings with relevant standards and client compliance requirements.

• Assist with secure code reviews and threat modeling when necessary.

• Stay updated on emerging attack techniques, tools, and vulnerabilities.

• Engage in projects for clients based in Australia.

⛳️ Requirements

• [3–5]+ years of practical experience in application penetration testing.

• In-depth understanding of the OWASP Top 10, OWASP ASVS, and OWASP API Security Top 10.

• Proficient with Burp Suite and other common testing tools (e.g., Nmap, SQLmap, Postman, Frida, MobSF).

• Familiarity with authentication and authorization protocols (OAuth 2.0, OIDC, JWT, SAML).

• Ability to script in Python, Bash, or a comparable language.

• Knowledge of cloud platforms (AWS, Azure, or GCP) and their impact on application security.

• Strong written English skills along with report-writing capabilities.

• Capability to work independently and adhere to project deadlines.

• Understanding of Australian local data protection and cybersecurity compliance regulations is a significant plus.

🏝️ Benefits

• Part-time employment