Senior penetration engineer

Responsibilities:

Application Penetration Testing

• Conduct security assessments on web, mobile, and cloud applications to identify vulnerabilities.
• Perform advanced testing techniques, including business logic testing, API security analysis, and reverse engineering.
• Simulate attacks on applications to evaluate their resilience against real-world threats.
• Provide detailed technical reports with actionable remediation steps for identified vulnerabilities.

Infrastructure Penetration Testing

• Perform comprehensive penetration tests on on-premises and cloud infrastructure, including servers, networks, and endpoints.
• Identify and exploit vulnerabilities in firewalls, routers, load balancers, and other network devices.
• Evaluate Active Directory (AD) security configurations and recommend hardening techniques.
• Test and assess security controls for wireless networks, VPNs, and IoT devices.

General Responsibilities

• Develop detailed test plans and scripts based on industry standards (e.g., OWASP, NIST, OSSTMM).
• Collaborate with stakeholders to define testing scopes and ensure business requirements are met.
• Generate comprehensive and high-quality reports detailing findings, risks, and recommendations.
• Participate in remediation validation and retesting of resolved vulnerabilities.
• Stay updated on emerging threats, attack vectors, and security tools.
• Mentor and guide junior penetration testers in technical skill development and career growth.
• Communicate technical findings effectively to both technical and non-technical stakeholders.

Requirements:

Technical Skills

• Proficiency in penetration testing tools like Burp Suite, Metasploit, Kali Linux, Nmap, and Nessus.
• Expertise in application security concepts such as SQL injection, XSS, CSRF, and insecure deserialization.
• Strong understanding of network protocols, operating systems, and cloud platforms (AWS, Azure, GCP).
• Hands-on experience with manual testing techniques and scripting languages like Python, Bash, or PowerShell.
• Familiarity with compliance and regulatory standards (e.g., PCI DSS, ISO 27001, HIPAA).

Soft Skills

• Strong analytical and problem-solving skills.
• Excellent written and verbal communication skills.
• Ability to work independently and collaboratively in a team environment.

Education and Certifications

• Bachelors degree in Computer Science, Cybersecurity, or a related field (or equivalent experience).
• Certifications such as OSCP, CEH are strongly preferred.
• At least 5-6 years of relevant penetration testing experience.