Pentester \ MA Analyst

We're hiring a technical security professional to work across two connected disciplines: penetration testing our portfolio companies' applications and infrastructure, and M&A Technical Due Diligence on acquisition targets for a private equity firm.
Your first 2-3 months are dedicated to M&A Technical Due Diligence: learning our existing scan and analysis process, running it on real or recent deals, and taking technical ownership of how it's done - including evaluating new tools and improving methodology over time. You'll have a Project Manager handling client coordination and report delivery throughout, the same way our pentest engagements work today - your job is the technical analysis and findings, not managing the client relationship.
After that, your time splits. Most weeks you'll run penetration tests for our portfolio companies. M&A due diligence work is driven by live deal activity, not a calendar - Divoro supports roughly 10-12 engagements a year, unevenly spaced, so some months bring several deals back-to-back and others bring none. When a deal is active, it takes priority over the pentest queue - the rest of the team covers you.

Responsibilities:

Penetration Testing
Conduct black-box, gray-box penetration tests against web applications, APIs, and network/infrastructure environments
Identify, exploit, and document vulnerabilities (OWASP Top 10, CIS benchmarks, common infrastructure misconfigurations)
Write clear, actionable findings reports with risk ratings per CVSS calculator and remediation guidance
Retest fixes and validate remediation effectiveness

M&A Analyst (Static Analysis)
Run Divoro's M&A Technical Due Diligence scans and analysis on acquisition targets, using tools such as Snyk (OSS/license risk), SonarQube (code quality, technical debt, complexity), and Claude-assisted code analysis — not limited to these; evaluate and propose new tools as the practice's needs evolve
Assess code quality, technical debt, complexity, and engineering team signals, and document clear, well-supported findings — the same standard as a pentest report
Join deal-context intake calls and, when needed, help present findings to deal teams — coordinated by our Project Manager, who owns client communication and report delivery
Take technical ownership of how the practice evolves — recommend and validate methodology and tooling improvements, with input from the wider team

Requirements (MUST HAVE):
3-4 years of experience in penetration testing
Strong knowledge of web application and network/infrastructure testing methodologies
Strong understanding of the software product development cycle and product architecture, sufficient to interpret M&A scan findings independently
Experience with static analysis tools (e.g., SonarQube, Snyk, Checkmarx)
Solid understanding of common vulnerability classes and secure coding practices
Ability to communicate technical risk clearly
Comfortable working under confidentiality constraints and deal timelines