Key Responsibilities:
Penetration Testing:
Conduct regular penetration testing (manual and automated) to identify vulnerabilities in applications, networks, and systems.
Perform tests on a wide range of environments including web applications, network infrastructure, cloud environments, and IoT devices.
Simulate attacks (internal and external) to identify potential attack vectors and exploit vulnerabilities to assess the system's security.
Use various penetration testing tools such as Metasploit, Burp Suite, Kali Linux, Nmap, Wireshark, etc.
Vulnerability Assessments:
Identify, analyze, and assess system and application vulnerabilities.
Conduct security assessments to ensure proper configuration and identification of weaknesses in the environment.
Provide detailed findings and recommendations for fixing vulnerabilities based on risk and impact.
Reporting and Documentation:
Provide clear, concise, and comprehensive penetration testing reports, including findings, risk assessments, and actionable recommendations.
Present findings to stakeholders in a manner that is understandable to both technical and non-technical audiences.
Maintain accurate documentation of all tests, activities, and findings for regulatory compliance and auditing purposes.
Collaboration and Support:
Work closely with development teams and IT operations to assist in remediation efforts and to verify that identified vulnerabilities are addressed.
Assist in creating security policies and best practices to ensure the organization's security posture remains robust.
Provide expert advice and support during security incident investigations and help with incident response.
Security Research and Continuous Learning:
Stay updated with the latest penetration testing methodologies, security vulnerabilities, and emerging threats.
Participate in bug bounty programs and Capture The Flag (CTF) challenges to sharpen skills and remain informed on current attack vectors and exploits.
Contribute to the development and improvement of internal penetration testing frameworks.
Compliance and Risk Management:
Ensure that penetration testing activities comply with internal security policies and relevant industry regulations (e.g., ISO 27001, GDPR, NIST, PCI DSS).
Provide input and recommendations on security architecture and assist with compliance audits and assessments.
Collaborate with the security team to develop strategies for managing identified risks and vulnerabilities.
Required Qualifications:
Bachelor's degree in Computer Science, Information Security, Network Security, or a related field, or equivalent practical experience.
3+ years of experience in penetration testing, ethical hacking, or cybersecurity roles.
Proven experience with common penetration testing tools (e.g., Burp Suite, Metasploit, Nmap, Wireshark, OWASP ZAP).
Strong knowledge of network protocols (e.g., TCP/IP, DNS, HTTP), web application security, and network security.
Experience with cloud security (e.g., AWS, Azure, Google Cloud).
Solid understanding of vulnerability management and risk assessments.
Experience with various operating systems including Linux, Windows, and macOS.
Understanding of web application firewalls (WAF) and security features like SSL/TLS, HTTP headers, and authentication mechanisms.
Familiarity with ethical hacking standards and OWASP Top 10.
Ability to effectively communicate security findings to both technical and non-technical stakeholders.

Penetration Testing

Job Description

Required Skills