Senior Penetration Tester - Vulnerability Assessment

Key Responsibilities:

- Conduct penetration testing and vulnerability assessments across web applications, APIs, networks, mobile applications, and cloud infrastructure.

- Perform security testing to identify vulnerabilities such as SQL injection, cross-site scripting (XSS), CSRF, authentication and authorization flaws, and privilege escalation.

- Execute security assessments using SAST, DAST, and Software Composition Analysis (SCA) tools.

- Conduct red team exercises and adversarial simulations to evaluate security controls and identify attack paths.

- Assess cloud security configurations across AWS, Azure, or GCP environments.

- Use automated tools and manual testing techniques to identify, validate, and exploit security weaknesses.

- Document findings with risk ratings, proof of concept, business impact, and remediation recommendations.

- Collaborate with development, infrastructure, and security teams to validate fixes and improve security posture.

- Prepare detailed penetration testing reports and present findings to technical and business stakeholders.

- Mentor junior team members and contribute to security testing methodologies and best practices.

Required Technical Skills:

- Strong hands-on experience in penetration testing, ethical hacking, vulnerability assessment, and red teaming.

- Expertise in web application, API, network, mobile, and cloud penetration testing.

- Strong knowledge of OWASP Top 10, OWASP API Security Top 10, SQL injection, XSS, CSRF, authentication bypass, and privilege escalation.

- Experience with SAST, DAST, and SCA tools and techniques.

- Proficiency with tools such as Burp Suite, Kali Linux, Metasploit, and Nmap.

- Scripting or automation experience using Python, Bash, PowerShell, or Ruby.

- Knowledge of security frameworks and methodologies, including OWASP, NIST, and MITRE ATT&CK.

- Hands-on experience assessing cloud security across AWS, Azure, or GCP.

- Strong understanding of networking, operating systems, HTTP/S, authentication mechanisms, encryption, and common security controls.

- Ability to reproduce vulnerabilities, assess their impact, and recommend effective remediation.