Penetration Tester

Responsibilities:

• Penetration Testing Execution: Perform security testing across web, API, and mobile applications, combining manual testing (priority) with automated scans using tools like Burp Suite and OWASP ZAP, while identifying vulnerabilities aligned to OWASP Top 10 and API Top 10.
• False Positive Analysis (Critical): Analyze SAST, DAST, and AI tool findings to validate exploitability, eliminate false positives with supporting evidence, correlate automated and manual results, and justify reclassification where required.
• Exploitation & Validation: Develop PoCs and simulate real-world attack scenarios including input manipulation, authentication bypass, and business logic abuse to validate vulnerabilities effectively.
• Insurance Domain Testing: Assess workflows such as claims processing, policy management, and payment integrations, with a focus on identifying business logic flaws impacting financial transactions and data integrity.
• Reporting & Documentation: Create clear, actionable reports covering issue details, validation steps, risk/impact, and remediation recommendations, and support audit discussions and fix validations.

Must-Have Skills:

• Security Testing: Strong knowledge of OWASP Top 10, API Security Top 10, authentication/session flaws, and vulnerabilities such as Injection, XSS, IDOR, and SSRF.
• Tools & Technologies: Hands-on experience with Burp Suite, OWASP ZAP, Nmap, Nikto, and SAST/DAST tools.
• Technical Skills: Basic scripting (Python/Bash) with solid understanding of HTTP/HTTPS, REST APIs, JSON, and authentication mechanisms like JWT and OAuth.
• False Positive Handling: Ability to interpret scanner outputs, perform manual validation, and provide evidence-based conclusions.
• Experience: 3-6 years in penetration testing with exposure to enterprise application security.