Penetration Tester

Overview

Execute external network, web application, and API penetration testing engagements, identifying and manually exploiting vulnerabilities and delivering clear client reports with remediation guidance.

What you'll do

• Execute external network, web application, and API penetration testing engagements in accordance with defined scopes, methodologies, and rules of engagement
• Identify, validate, and manually exploit vulnerabilities using public exploits, internally developed techniques, or a combination of approaches
• Evaluate attack paths and determine the potential business and technical impact of identified vulnerabilities
• Compile and write clear, accurate, and defensible client reports that explain findings, risk, evidence, and remediation guidance
• Communicate with clients throughout engagements, including technical discussions, findings walkthroughs, and responses to questions or challenges
• Execute assigned projects with minimal oversight while maintaining quality, professionalism, and attention to detail
• Collaborate with team members to evaluate offensive security tools and improve testing methodologies, delivery processes, and reporting standards
• Share technical knowledge and practical guidance with less-experienced team members and clients when appropriate
• Maintain current knowledge of emerging vulnerabilities, attack techniques, security research, and industry trends

What you'll need

• Master's or Bachelor's degree in cybersecurity, management information systems, computer science, or relevant discipline
• 2-5 years of hands-on penetration testing experience in at least one of the following areas: External Penetration Tests, Web Application Penetration Tests, API Penetration Tests, Mobile Application Penetration Tests
• Experience independently executing penetration testing engagements and producing high-quality client deliverables
• Knowledge of established penetration testing methodologies and disciplined evidence collection practices
• Experience identifying and manually validating exploitable vulnerabilities rather than relying solely on automated scanning
• Experience communicating technical findings, risk, and remediation guidance clearly to clients and internal stakeholders
• Proficiency with commonly used offensive security tools such as Nmap, SQLmap, Burp Suite, Postman, Nuclei, Wireshark, Nessus, and Caido
• Proficiency with one or more scripting languages such as Python, Bash, JavaScript, PowerShell, or SQL
• Solid understanding of web technologies, networking concepts, authentication, access control, and common application security weaknesses
• Ability to work independently as well as collaboratively in a remote, fast-paced environment
• Excellent written and verbal communication skills, with the ability to explain technical issues to different audiences
• Ability to meet deadlines while maintaining a high degree of motivation, self-discipline, and quality

Nice to have

• OSCP, eWPT, eWPTX, OSWA, or OSWE certification

Details

• Location: United States, remote
• Employment type: Full-Time, Exempt
• Reports to Director, Web Application & External Offensive Operations