Penetration Testing Engineer

What you'll do

• Execute web application, API, and cloud security assessments across enterprise environments.
• Perform penetration testing and adversarial assessments against internal and third-party applications.
• Validate and prioritize security findings generated by autonomous and AI-assisted testing platforms.
• Identify complex attack paths involving authentication weaknesses, authorization flaws, and business logic vulnerabilities.
• Implement and manage integrations between testing platforms and vulnerability management workflows.
• Develop and maintain testing methodologies, automation workflows, and security assessment procedures.
• Partner with engineering teams to explain findings and validate remediation efforts through retesting.
• Create program documentation including playbooks, runbooks, technical standards, and training materials.

What we're looking for

• 4+ years of experience in cybersecurity, application security, penetration testing, offensive security, or a related field.
• Bachelor's degree or an equivalent combination of education and experience.
• Experience performing web application and API penetration testing.
• Experience validating security vulnerabilities, assessing exploitability, and distinguishing actionable findings from false positives.
• Experience assessing enterprise applications using REST APIs, GraphQL APIs, authentication systems, and cloud-native technologies.
• Working knowledge of AWS, Azure, or Google Cloud Platform (GCP) security concepts.
• Experience documenting technical findings and communicating remediation guidance to engineering teams.
• Hands-on experience with Burp Suite Professional, Nuclei, Nmap, Metasploit, Postman, and Kali Linux tools.
• Experience leveraging AI-assisted security tools and security automation platforms (preferred).
• Experience implementing, operating, or scaling continuous security testing or automated offensive security capabilities (preferred).
• Experience assessing AI-enabled applications, agent-based systems, LLM integrations, or AI security risks (preferred).
• Familiarity with DevSecOps, CI/CD security controls, and secure software development practices (preferred).
• Knowledge of OWASP Top 10, API Security Top 10, threat modeling, and secure design principles (preferred).
• Experience conducting red team, adversarial simulation, or attack path validation exercises (preferred).
• Experience performing cloud security assessments in AWS, Azure, and GCP environments (preferred).
• Experience creating custom security testing scripts and automation workflows (preferred).
• Experience developing proof-of-concept exploits and adversary emulation scenarios (preferred).
• Relevant certifications such as OSCP, OSWE, OSWA, OSAI, HTB CWES, HTB CWEE, OSEP, GPEN, GWAPT or equivalent (preferred).