Lead Penetration Test Engineer

What you'll do

• Conduct manual and automated penetration tests on web applications, infrastructure, and cloud environments.
• Develop custom scripts and tools to automate security testing within CI/CD pipelines.
• Execute cloud-specific offensive techniques including IAM abuse and container exploitation.
• Perform DAST, SAST, and SCA scans to validate and improve security controls.
• Lead attack simulations and tabletop exercises to test organizational response capabilities.
• Research emerging threats and adversarial techniques to inform defensive strategies.
• Translate complex technical findings into actionable reports for both technical and non-technical stakeholders.
• Provide remediation guidance to engineering teams to strengthen application security across the lifecycle.

What we're looking for

• Minimum of 8 years of experience in information security with a focus on penetration testing, application security, and vulnerability management.
• Proficiency with tools such as Burp Suite, Nessus, Metasploit, and Nmap using methodologies like OWASP Top 10 and MITRE ATT&CK.
• Expertise in identifying and exploiting infrastructure and web application vulnerabilities including XSS, SQL Injection, and IDOR.
• Strong scripting or programming skills in languages such as Bash, Python, Go, PowerShell, or JavaScript.
• Experience performing DAST, SAST, and SCA assessments and integrating security testing into CI/CD pipelines.
• Ability to communicate complex technical findings and remediation strategies to both technical and non-technical stakeholders.
• Possession of at least one recognized offensive security certification such as OSCP, OSCE3, OSEP, GXPN, GPEN, or CREST CRT/CCT.
• Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.