Penetration Tester | Vulnerability Analyst

Role Overview

We are seeking a knowledgeable and security-oriented Penetration Tester | Vulnerability Analyst to detect, assess, and support remediation of security gaps within applications, networks, systems, and digital infrastructure. This position involves combining practical security evaluation, vulnerability identification, risk assessment, and technical reporting to enhance the organization's overall security stature.

Key Responsibilities

• Carry out authorized penetration tests on web applications, APIs, network components, servers, cloud setups, and other sanctioned systems.
• Execute vulnerability assessments to uncover security flaws, misconfigurations, obsolete components, and exposure risks.
• Establish testing scope, goals, methodologies, engagement rules, and assessment prerequisites.
• Perform reconnaissance and asset identification within the granted testing boundaries.
• Evaluate applications and infrastructure for prevalent security vulnerabilities and misconfigurations.
• Utilize both manual and automated security testing tools aligned with industry standards.
• Confirm the validity of identified vulnerabilities, separating genuine threats from false positives.
• Assess the severity of vulnerabilities based on technical impact, exploit potential, business risk, and overall exposure.
• Analyze potential attack paths and identify how multiple weaknesses might compound risks.
• Test key security mechanisms such as authentication, authorization, session control, input validation, and access restrictions.
• Assess APIs, web services, mobile apps, and cloud services where relevant.
• Conduct security evaluations of network and infrastructure components within authorized internal and external environments.
• Review system configurations, security controls, network architecture, and documentation.
• Perform vulnerability scans and prioritize issues following organizational risk management guidelines.
• Research newly announced vulnerabilities, advisories, exploits, and evolving attack techniques.
• Monitor trends in vulnerabilities and evaluate potential impacts on organizational assets.
• Collaborate with system admins, developers, DevOps, and security engineers to investigate security findings.
• Provide clear technical guidance for remediating discovered vulnerabilities.
• Conduct re-testing post-remediation to verify vulnerability resolution.
• Create comprehensive penetration testing and vulnerability assessment reports tailored to technical and managerial stakeholders.
• Document evidence, affected assets, risk ratings, and recommended corrective actions.
• Present findings to stakeholders, explaining technical risks in understandable business terms.
• Maintain detailed records of vulnerabilities, remediation status, testing activities, and security findings.
• Support and contribute to the organization's vulnerability management and security enhancement programs.
• Improve security testing methods, assessment processes, automation, and reporting workflows.
• Uphold strict confidentiality and ensure all testing adheres to authorized scope and approved procedures.

Candidate Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related discipline.
• Prior hands-on experience in penetration testing, vulnerability assessment, security testing, or cybersecurity analysis.
• Comprehensive knowledge of network security, operating systems, web applications, APIs, databases, and cloud platforms.
• Understanding of common web and application security risks based on OWASP guidelines.
• Experience with vulnerability scanners, penetration testing utilities, network analysis tools, and security testing frameworks.
• Familiarity with tools such as Burp Suite, Nmap, Nessus, OpenVAS, Wireshark, or similar security utilities is beneficial.
• Strong grasp of TCP/IP, DNS, HTTP/HTTPS protocols, VPNs, firewalls, authentication systems, and network architecture.
• Experience working in Linux and Windows security contexts.
• Solid knowledge of vulnerability management, risk analysis, CVE/CVSS frameworks, and remediation practices.
• Ability to validate vulnerabilities and execute controlled security tests.
• Basic to advanced scripting capabilities in Python, PowerShell, Bash, or related scripting languages is advantageous.
• Familiarity with cloud security principles for AWS, Azure, or Google Cloud platforms is preferred.
• Understanding of identity and access management, endpoint security, application security, and infrastructure security.
• Strong analytical problem-solving skills.
• Excellent technical writing and reporting proficiency.
• Clear communication skills for conveying complex security findings to both technical and non-technical audiences.
• Meticulous attention to detail to identify nuanced security vulnerabilities.
• Capability to work autonomously while effectively collaborating across security, development, infrastructure, and operations teams.
• High ethical standards with strict compliance to authorized testing protocols and security policies.
• Knowledge of security standards and frameworks such as NIST, ISO 27001, CIS Controls or related guidelines is advantageous.
• Certifications like OSCP, CEH, GPEN, Security+, eJPT, PNPT, or equivalents are favored.

Compensation and Benefits

• Competitive remuneration and an extensive benefits package.
• Exposure to varied cybersecurity evaluation and vulnerability management initiatives.
• Work involving web applications, APIs, networking, cloud infrastructure, and enterprise-level security environments.
• Access to professional training in penetration testing, vulnerability analysis, and cloud security.
• Utilization of cutting-edge security testing platforms and technology.
• Collaboration with seasoned security engineers, developers, infrastructure teams, and security leadership.
• Support for earning recognized security certifications and career development.
• Opportunities to contribute to security enhancement, risk management, and digital transformation projects.
• Insight into emerging vulnerabilities, attack methodologies, defense technologies, and security trends.
• Acknowledgment for high-quality assessments and effective remediation guidance.
• Career advancement paths toward Senior Penetration Tester, Vulnerability Management Lead, Security Consultant, Red Team Specialist, or Cybersecurity Manager roles.