Penetration Tester

Role overview

Application security testing

• Perform black-box, grey-box, and white-box penetration testing on web and mobile applications.
• Identify, exploit, and document vulnerabilities using industry standards such as OWASP Top 10 and OWASP Mobile Top 10.
• Conduct secure code reviews when required.
• Test authentication bypass, session management, APIs, microservices, modern web architectures, and mobile applications.
• Support red team exercises when required.

Analysis and reporting

• Assess vulnerabilities for business and technical impact.
• Produce reports with executive summaries, technical findings, risk ratings, and remediation recommendations.
• Present findings to clients and support remediation discussions.

Tools, clients, and research

• Use tools such as Burp Suite, OWASP ZAP, Metasploit, MobSF, and Frida; develop custom testing scripts or tools.
• Follow structured methodologies and frameworks such as OWASP and PTES.
• Understand client application architecture and testing scope, provide remediation guidance, and support retesting.
• Track emerging vulnerabilities and contribute to knowledge sharing, labs, and research initiatives.
• Participate in training, certifications, and cybersecurity events.

Required qualifications

• Degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.
• At least 2 years of application security testing experience in web and/or mobile.
• Strong knowledge of web technologies, including HTTP/S, APIs, and authentication mechanisms.
• Experience with iOS or Android and related security risks; hands-on penetration testing tool experience.
• Solid understanding of OWASP Top 10 and secure coding practices.
• Strong reporting and communication skills in English.

Additional qualifications

• Relevant certifications such as OSCP, OSWE, eWPT, eMAPT, or CEH are listed as qualifications.
• Mobile reverse engineering experience, cloud familiarity, API security testing, and GCC client experience are listed as qualifications.
• Analytical ability, attention to detail, interpersonal and teamwork skills, and composure under stress are sought.
• Arabic is an advantage; travel within the GCC may be required for on-site engagements.

Workplace and travel

• Candidates are asked to reside in the UAE.
• Travel within the GCC for on-site client engagements may be required.

Why join

• The employer describes a growing cybersecurity environment, a collaborative team culture, and work with potential impact on security operations and client success.