Vulnerability Assessment and Penetration Testing, Senior Engineer

Role overview

Security assessments

• Lead end-to-end web application testing covering OWASP Top 10, API security, and business logic flaws.
• Test internal and external network infrastructure, including Active Directory, firewalls, and routers.
• Conduct manual and tool-assisted secure code reviews and provide developer-focused remediation guidance.
• Test iOS and Android applications using static and dynamic analysis.
• Conduct vulnerability assessments and configuration reviews against CIS and NIST standards.
• Use and refine tools such as Burp Suite Pro, Metasploit, Nmap, Nessus, and Bloodhound; develop custom scripts or exploits when needed.

Client engagement and reporting

• Define scope, rules of engagement, and timelines with clients.
• Serve as the primary technical contact, provide updates, and promptly communicate critical findings.
• Write executive-level reports translating technical vulnerabilities into business risk and actionable fixes.
• Lead technical read-out sessions and remediation workshops.

Optional assessment areas

• Participate in red teaming, adversary simulation, social engineering, and physical security assessments as a preferred capability.
• Review and exploit cloud configurations in AWS, Azure, or GCP as a preferred capability.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 5+ years of information security experience, including at least 3+ years specifically in penetration testing or VAPT.
• Deep understanding of HTTP, SOAP, REST, AJAX, and secure coding practices.
• Strong knowledge of Active Directory attack paths, including Kerberoasting, DCSync, and ACL abuse.
• Experience with manual exploitation techniques, not only automated scanners.
• Proficiency in at least one scripting language: Python, PowerShell, Bash, or Ruby.
• Consulting or service-provider experience is highly preferred.

Preferred certifications

• Certifications such as eMAPT, eWPTX, eCPTX, OSCP, or CWEE are preferred, not mandatory.

About SOOR