Senior Penetration Tester
Role Overview
Threatspike Labs as a whole provides many types of penetration testing and red team adversary engagements that clients may choose from.
This includes but is not limited to web and API testing, external and internal infrastructure testing, wireless and physical testing, as we as mature red team and assumed breach testing.
A penetration tester at Threatspike Labs will be expected to continue taking their professional development seriously.
Roles and Responsibilities
You would not be expected to perform solo assumed breaches or Red Team engagements.
In this role, your primary duties will involve executing web application, internal, and external assessments following established industry frameworks like OWASP and MITRE ATT&CK.
You may also provide mentorship by pairing with junior or mid-level penetration testers to guide them through their assessments.
Based on your specific areas of specialization, you could be asked to participate in client meetings to address inquiries regarding various testing types.
Additionally, you will occasionally be involved in supporting specific phases of larger Red Team engagements.
A perfect candidate would have:
• Motivation, passion and determination. This is what you can not learn from a course. Questions you should be asking yourself are: How do I stay up to date with emerging adversary tradecraft, tooling and TTPs relevant to red team operations? How do I growmy personal knowledge base and grow my capabilities, can I start looking at implementing what I know in more OPSEC ways? Do I have personal goals that I have set for myself to better progress in my craft?
• Excellent problem-solving skills: You already have a mature research methodology set\p to handle unknown problems that arise during testing. If clients request an irregular approach to testing, you can propose a possible solution.
• Fully understand low level concepts including operating systems, networking, networking protocols, and the OSI model. You can make use of advanced TTPs on these different levels; understand where it may be necessary to develop custom solutions to overcome testing obstacles; and to understand your testing environments, and how systems react to the execution of pentesting tools.
• Experience with programming where you can understand code and identify vulnerabilities, as well as being capable of writing code to create scripts or tooling to aid in achieving testing goals.
• Hands-on experience using different operating systems and networking technologies. At this level of job role, it should be expected that you have practiced experience with labs and training as well as real life experience testing industry environments and industry level technologies from professional testing setups.
• Excellent communication skills. As a senior penetration tester, you will be responsible for presenting your findings in debriefs, as well as communicating with clients throughout your engagements. You should be able to come across professionally and avoid miscommunication that could lead to delays or cause confusion. Additionally, you should be able to advise junior testers effectively and in an appropriate manner so that they can benefit from your experience and grow as testers.
• When looking at certification, you should be looking at more advanced certifications that focus on more advanced topics or niche areas of testing.
• In this role you will be expected to use various industry standard and in-house tools, including (but not limited to) the following or equivalents: External Mapping: Nmap, eyewitness, dirbuster, dig, etc Web Exploitation: Burpsuite, XSStrike, SqlMap, etc Phishing: EvilGinx, GoPhish Vulnerability Scanning: Nessus, Nikto ThreatSpike Wire – You would receive training on how to use our in house platform. Internal testing: Bloodhound and collectors, Rubeus, Snaffler, Responder, GetUserSPNs.py.
In addition to using the above tooling you should be looking at OPSEC safe alternatives or OPSEC safe methodology to achieve the same goals as some of these tools.
Learning and Development
Any candidate must have the ability and desire to understand and learn new concepts on their own in addition to the training we will provide.
We are committed to helping the selected candidate obtain professional certifications.
The goal is not for the candidate to remain a senior tester if accepted for the position, but then to advance internally by upskilling.
Full Job Posting
About the Company
ThreatSpike is the world’s first AI-managed platform to deliver fully managed IT and complete cybersecurity as a single, fixed price subscription. One platform replaces the fragmented model of MSPs, MSSPs and point-solution vendors with one platform, one accountable team and one predictable monthly price.
As the first company to operate as both the technology vendor and the service provider simultaneously, ThreatSpike ships fixes directly into the platform the moment problems are found. Every customer benefits immediately.
Every capability ThreatSpike delivers runs inside a single platform, under one team. Not split between an IT provider, a security vendor and a pen testing firm that have never spoken to each other. There are no gaps between the tools. There are no gaps between the teams. There is no ambiguity about who owns the outcome.
About the Job
Threatspike Labs as a whole provides many types of penetration testing and red team adversary engagements that clients may choose from. This includes but is not limited to web and API testing, external and internal infrastructure testing, wireless and physical testing, as we as mature red team and assumed breach testing.
A penetration tester at Threatspike Labs will be expected to continue taking their professional development seriously.
Roles and Responsibilities
- You would not be expected to perform solo assumed breaches or Red Team engagements. In this role, your primary duties will involve executing web application, internal, and external assessments following established industry frameworks like OWASP and MITRE ATT&CK. You may also provide mentorship by pairing with junior or mid-level penetration testers to guide them through their assessments. Based on your specific areas of specialization, you could be asked to participate in client meetings to address inquiries regarding various testing types. Additionally, you will occasionally be involved in supporting specific phases of larger Red Team engagements.
A perfect candidate would have
Motivation, passion and determination. This is what you can not learn from a course. Questions you should be asking yourself are: How do I stay up to date with emerging adversary tradecraft, tooling and TTPs relevant to red team operations? How do I growmy personal knowledge base and grow my capabilities, can I start looking at implementing what I know in more OPSEC ways? Do I have personal goals that I have set for myself to better progress in my craft?
Questions you should be asking yourself are: How do I stay up to date with emerging adversary tradecraft, tooling and TTPs relevant to red team operations?
How do I growmy personal knowledge base and grow my capabilities, can I start looking at implementing what I know in more OPSEC ways?
Do I have personal goals that I have set for myself to better progress in my craft?
Excellent problem-solving skills: You already have a mature research methodology set\p to handle unknown problems that arise during testing. If clients request an irregular approach to testing, you can propose a possible solution.
Fully understand low level concepts including operating systems, networking, networking protocols, and the OSI model. You can make use of advanced TTPs on these different levels; understand where it may be necessary to develop custom solutions to overcome testing obstacles; and to understand your testing environments, and how systems react to the execution of pentesting tools.
Experience with programming where you can understand code and identify vulnerabilities, as well as being capable of writing code to create scripts or tooling to aid in achieving testing goals.
Hands-on experience using different operating systems and networking technologies. At this level of job role, it should be expected that you have practiced experience with labs and training as well as real life experience testing industry environments and industry level technologies from professional testing setups.
Excellent communication skills. As a senior penetration tester, you will be responsible for presenting your findings in debriefs, as well as communicating with clients throughout your engagements. You should be able to come across professionally and avoid miscommunication that could lead to delays or cause confusion. Additionally, you should be able to advise junior testers effectively and in an appropriate manner so that they can benefit from your experience and grow as testers.
When looking at certification, you should be looking at more advanced certifications that focus on more advanced topics or niche areas of testing.
In this role you will be expected to use various industry standard and in-house tools, including (but not limited to) the following or equivalents: External Mapping: Nmap, eyewitness, dirbuster, dig, etc Web Exploitation: Burpsuite, XSStrike, SqlMap, etc Phishing: EvilGinx, GoPhish Vulnerability Scanning: Nessus, Nikto ThreatSpike Wire – You would receive training on how to use our in house platform. Internal testing: Bloodhound and collectors, Rubeus, Snaffler, Responder, GetUserSPNs.py.
External Mapping: Nmap, eyewitness, dirbuster, dig, etc
Web Exploitation: Burpsuite, XSStrike, SqlMap, etc
Phishing: EvilGinx, GoPhish
Vulnerability Scanning: Nessus, Nikto
ThreatSpike Wire – You would receive training on how to use our in house platform.
Internal testing: Bloodhound and collectors, Rubeus, Snaffler, Responder, GetUserSPNs.py.
In addition to using the above tooling you should be looking at OPSEC safe alternatives or OPSEC safe methodology to achieve the same goals as some of these tools.
Learning and Development
Any candidate must have the ability and desire to understand and learn new concepts on their own in addition to the training we will provide. We are committed to helping the selected candidate obtain professional certifications. The goal is not for the candidate to remain a senior tester if accepted for the position, but then to advance internally by upskilling.
Location
- This is a remote role and we are hiring in the following countries:
- United Kingdom
- United States
- Singapore
- United Arab Emirates
- Should the candidate be London-based, there is an opportunity for optional hybrid working from our Mayfair office to socialise and collaborate with other members of the team. However this is not a requirement.
About ThreatSpike
AI-managed IT and cybersecurity provider delivering fully managed IT, defensive security, and penetration testing to organizations.
Visit company websiteApply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer