Consultant - Cybersecurity, Penetration Testing

Role Purpose

Engagement Scoping & Planning

• Define testing objectives, scope, prerequisites, and deliverables with asset owners and relevant cybersecurity stakeholders.
• Prepare engagement plans and rules of engagement covering authorization, permitted techniques, testing windows, and escalation arrangements.
• Assess testing risks and coordinate access and operational safeguards before commencing approved activities.

Application & API Penetration Testing

• Perform authorized penetration testing of web applications, mobile applications, and APIs within the agreed scope.
• Assess authentication, authorization, session management, input handling, and business logic controls using manual and automated techniques.
• Validate identified weaknesses and document reproducible evidence and potential business impacts.

Infrastructure & Platform Penetration Testing

• Assess in-scope internal and external networks, systems, and cloud environments for exploitable weaknesses and configuration gaps.
• Evaluate attack paths, privilege boundaries, and exposure of sensitive services through controlled testing within approved limits.
• Coordinate with technical owners to manage testing dependencies and promptly escalate unexpected operational impacts.

Vulnerability Validation & Risk Analysis

• Analyze testing results, remove false positives, and assess the exploitability and impact of confirmed findings.
• Prioritize findings using the approved risk assessment approach, considering asset criticality, exposure, and compensating controls.
• Identify related weaknesses and attack chains to explain potential impacts on critical services and information assets.

Technical Reporting & Remediation Advisory

• Produce penetration testing reports covering scope, approach, findings, supporting evidence, risk ratings, and remediation recommendations.
• Communicate technical findings and business implications to asset owners and relevant stakeholders.
• Advise technical teams on practical corrective measures and clarify findings throughout remediation.

Remediation Validation & Closure

• Conduct retesting to verify corrective actions and assess whether identified weaknesses have been adequately addressed.
• Maintain accurate finding status and supporting evidence, and escalate overdue or unresolved issues through established channels.
• Document residual weaknesses and provide technical input to formal closure or risk acceptance decisions by authorized owners.

Testing Methods, Tools & Quality

• Maintain and improve testing procedures, checklists, and reusable scripts in line with approved methodologies.
• Evaluate testing tools and techniques in controlled environments and recommend improvements to coverage and efficiency.
• Review technical evidence and reports, share specialist knowledge, and provide guidance to colleagues to support consistent testing quality.

Stakeholder Coordination & Technical Research

• Coordinate engagement schedules, dependencies, and deliverables with business stakeholders, technology teams, and external testing providers.
• Research emerging vulnerabilities and attack techniques relevant to the organization's technology landscape and incorporate applicable scenarios into approved testing.
• Maintain engagement records and handle credentials, test data, and evidence securely throughout testing and closure.

Job Specifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
• Relevant professional certifications in penetration testing or offensive security are considered an advantage.
• 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security, including hands-on testing, technical reporting, and remediation validation.