Senior Penetration Tester

About the role

We are looking for an experienced Senior Penetration Tester to lead comprehensive security assessments across web applications, APIs, network infrastructure, Active Directory environments, and client‑server applications. The role involves identifying, exploiting, and documenting vulnerabilities while providing clear remediation guidance to strengthen our security posture.

Key responsibilities

• Conduct penetration testing of web applications, APIs, and other application environments.
• Perform application security assessments using SAST and DAST tools and manual source code reviews.
• Execute internal and external network penetration tests and Active Directory security assessments.
• Test thick‑client and thin‑client applications, including authentication and communication mechanisms.
• Carry out OSINT activities to discover publicly exposed assets and potential attack surfaces.
• Prepare detailed technical reports with findings, risk ratings, proof of concept, business impact, and remediation recommendations.
• Collaborate with development, infrastructure, and security teams to validate findings and support remediation, including retesting.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, IT or equivalent practical experience.
• Minimum 5 years of hands‑on penetration testing or offensive security experience.
• Strong understanding of common vulnerabilities, exploitation techniques, and security testing methodologies.
• Relevant certifications such as CRTP, CPTS, OSCP, PNPT, OSWE, GWAPT are a plus.
• Excellent analytical, troubleshooting, communication, and report‑writing skills.

Required skills

• Web application and API penetration testing (OWASP Top 10, authentication/authorization testing).
• SAST/DAST tools: SonarQube, Checkmarx, Fortify, Veracode.
• Source code analysis: Semgrep, CodeQL, manual review.
• Active Directory assessment tools: BloodHound, Impacket, NetExec, Mimikatz.
• Network penetration tools: Nmap, Nessus, Metasploit.
• OSINT tools: Maltego, theHarvester, Amass.
• Application security tools: Burp Suite Professional, OWASP ZAP, Postman.
• Operating systems: Kali Linux, Windows, Linux server environments.