Internal Penetration Tester

Overview

Internal Penetration Tester responsible for executing internal network and cloud-based SaaS penetration testing engagements for Pathfynder by A-LIGN, reporting to the Director, Internal Offensive Operations.

What you'll do

• Execute internal network and cloud-based SaaS penetration testing engagements
• Identify, validate, and manually exploit vulnerabilities using public exploits, custom-developed exploits, or a combination of techniques
• Evaluate findings in context, explore realistic attack paths, and accurately assess business and technical risk
• Deliver clear, accurate, client-ready reports that explain findings, evidence, and actionable remediation guidance
• Communicate technical issues, testing results, and remediation recommendations to client stakeholders
• Maintain project quality and timelines while executing assigned engagements with minimal oversight
• Collaborate with the offensive security team to evaluate industry tools, improve delivery methods, and share technical knowledge
• Mentor team members and contribute to the continued development of team capabilities

What you'll need

• Degree in cybersecurity, computer information systems, related discipline or equivalent professional
• 5+ years of hands-on offensive security experience, including at least 3 years focused on internal network, Active Directory, red team, or purple team penetration testing
• Experience with network and system exploitation across enterprise environments
• Knowledge of penetration testing methodologies and current offensive security practices
• Experience applying current tactics, techniques, and procedures related to EDR bypass, lateral movement, and privilege escalation
• Knowledge of Active Directory attack paths, network exploitation, lateral movement, privilege escalation, and defence evasion techniques
• Proficiency with scripting languages such as Python, Bash, JavaScript, PowerShell, or SQL
• Proficiency with commonly used offensive security tools such as Nmap, BloodHound, the Impacket suite, Metasploit, Wireshark, and Nessus
• Knowledge of multiple penetration testing concentrations and the ability to select appropriate methodologies and tools
• Ability to write clear, concise, client-ready reports with accurate findings and actionable remediation guidance
• Excellent verbal and written communication skills, with the ability to explain technical risks to technical and non-technical audiences
• Ability to work independently and collaboratively in a fast-paced, remote environment while meeting deadlines
• Passion for information security and identifying exploitable vulnerabilities before threat actors can take advantage of them
• Ability to discover and exploit complex vulnerabilities while maintaining a disciplined and repeatable approach to testing
• Continuous desire to grow technical capabilities, improve delivery efficiency, and share knowledge with team members and clients

Nice to have

• Red team or purple team penetration testing experience
• Wireless penetration testing experience
• Consulting or client-facing security delivery experience
• OSCP, CEH, or OSEP certification
• Additional advanced certifications relevant to internal network, Active Directory, red team, or cloud security testing
• Cloud architecture knowledge across AWS, Microsoft Azure, or Google Cloud Platform

Details

• Location: United States, remote
• Employment type: Full-Time, Exempt