Penetration Tester | Vulnerability Analyst

Role overview

Responsibilities

• Conduct authorized penetration tests across web applications, APIs, networks, servers, cloud environments, and other approved systems.
• Assess vulnerabilities, misconfigurations, outdated components, exposure risks, and security controls; define scope, objectives, methodologies, and rules of engagement.
• Perform reconnaissance and asset discovery; use manual and automated testing to assess applications and infrastructure.
• Validate findings, eliminate false positives, assess severity and business exposure, and analyze potential attack paths.
• Test authentication, authorization, session management, input validation, access controls, APIs, web services, mobile applications, and cloud services where applicable.
• Review configurations, security controls, architectures, and documentation; scan for vulnerabilities and prioritize findings according to organizational risk.
• Research new vulnerabilities, advisories, exploits, and attack techniques and determine whether they affect organizational assets.
• Collaborate with administrators, developers, DevOps teams, and security engineers; recommend remediation and retest after fixes.
• Prepare detailed assessment reports, document evidence and risk, and present technical findings in business-relevant terms.
• Maintain vulnerability and testing records; support vulnerability management and improve testing methods, automation, procedures, and reporting.
• Maintain confidentiality and keep all security testing within authorized scope and approved procedures.

Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field.
• Previous experience in penetration testing, vulnerability assessment, security testing, or cybersecurity analysis.
• Strong understanding of network security, operating systems, web applications, APIs, databases, and cloud environments; familiarity with OWASP security principles.
• Experience with vulnerability scanners, penetration-testing tools, network-analysis tools, and security-testing frameworks.
• Knowledge of Burp Suite, Nmap, Nessus, OpenVAS, Wireshark, or comparable platforms is advantageous.
• Understanding of TCP/IP, DNS, HTTP/HTTPS, VPNs, firewalls, authentication, network architecture, Linux and Windows security.
• Strong knowledge of vulnerability management, risk assessment, CVE/CVSS concepts, remediation, and controlled security testing.
• Scripting in Python, PowerShell, Bash, or similar languages is advantageous; cloud-security knowledge is preferred.
• Strong analytical, documentation, communication, attention-to-detail, collaboration, and ethical-conduct skills; able to work independently.
• NIST, ISO 27001, CIS Controls, or similar framework familiarity and OSCP, CEH, GPEN, Security+, eJPT, PNPT, or equivalent certifications are advantageous.

What the employer offers

• Competitive salary and employee benefits; no salary amount or cadence is specified.
• Cybersecurity assessment projects, modern testing platforms, professional training, and support for recognized certifications.
• Collaboration with security, development, and infrastructure teams; opportunities for professional development and participation in security improvement initiatives.
• Career progression may include senior penetration tester, vulnerability management lead, security consultant, red team specialist, or cybersecurity manager.