11 PENETRATION TESTER JOBS

My client, a US cybersecurity consultancy, is looking for Pentesting / Threat Modelling professionals support their team.Qualifications:5+ years of professional experience in Offensive SecurityExperience in Web App / Network / APIs / Mobile App / Cloud Security / Thick Client or other kinds of PentestingWhitebox / Blackbox / Greaybox PentestingSource Code Review via Python, Bash, C/C++ or other common programming languagesRed Teaming engagements including Social Engineering, Reverse Engineering, Exploit Development, Threat Simulation etc.Threat Modelling and other Blue Teaming experienceExperience in collaborating with external clientsMust have at least one of the relevant certifications (e.g. OSCP/OSCE/OSEP/OSWE/GCPN etc.)

ApplyJob Summary:As a Penetration Tester, you will play a pivotal role in identifying vulnerabilities, assessing security measures, and enhancing the overall cybersecurity posture of our clients. Your expertise in testing applications, network infrastructure, and mobile apps will be instrumental in uncovering potential weaknesses and recommending robust solutions to mitigate risks. By executing comprehensive penetration testing methodologies, you will contribute to fortifying our clients' systems against potential cyber threats.Responsibilities:- Conduct thorough penetration testing on a diverse range of systems, including web applications, network infrastructure, and mobile applications.- Perform in-depth vulnerability assessments to identify potential security flaws and weaknesses in client systems.- Collaborate with cross-functional teams to plan and execute penetration testing projects, adhering to predefined timelines and objectives.- Utilize industry-standard tools and methodologies to simulate real-world cyber-attacks and assess the effectiveness of defense mechanisms.- Document and communicate findings, both in written reports and verbal presentations, detailing identified vulnerabilities, potential exploits, and recommended remediation strategies.- Stay updated on the latest cybersecurity threats, attack vectors, and vulnerabilities to ensure our testing techniques are current and effective.- Provide guidance and recommendations to clients on improving their security posture based on penetration test results.- Work closely with the development and IT teams to facilitate the implementation of security measures and patches.- Collaborate with clients to understand their specific security requirements and tailor penetration testing methodologies accordingly.- Participate in knowledge sharing and training activities to enhance the expertise of the cybersecurity team.Qualifications:- Bachelor's degree in Computer Science, Information Security, or related field; relevant certifications (e.g., CEH, OSCP Mandatory).- Proven experience of 4-5 years as a Penetration Tester, with a strong track record of successfully identifying and exploiting vulnerabilities in applications, network infrastructure, and mobile apps.- Proficiency in using a wide range of penetration testing tools, such as Burp Suite, Metasploit, Nmap, Wireshark, etc.- In-depth understanding of various operating systems (Windows, Linux, macOS) and their security features.- Familiarity with OWASP Top Ten and CWE/SANS Top 25 vulnerabilities.- Experience with both manual and automated penetration testing techniques.- Strong programming/scripting skills (e.g., Python, Ruby, PowerShell) to customize testing methodologies and tools.- Excellent analytical and problem-solving abilities, along with a keen attention to detail.- Effective communication skills to convey technical findings and recommendations to both technical and non-technical stakeholders.- Ability to work independently and as part of a collaborative team.- Strong commitment to continuous learning and staying current with the evolving cybersecurity landscape.

Penetration Tester ( Consultant / Sr. Consultant ) Job Location: India ( Remote )Company DescriptionCentric Consulting is an international management consulting firm with a team of experienced consultants centered on what’s best for the clients' businesses. The company was founded in 1999 and has 1,400 employees across 14 locations. Centric's expertise includes business transformation, AI strategy, cyber risk management, technology implementation and adoption. The company has won over 100 awards for its commitment to employees, clients and communities, including recognition as one of Forbes Best Management Consulting Firms in America for the 8th consecutive year.Are you passionate about working remotely and have expertise in Penetration Testing? If so, Centric Consulting has an exciting opportunity for you!Job Title: Penetration TesterExperience Required: 3+ YearsNotice Period: Immediate to 30 daysImmediate Joiners RequiredSkills:Bachelor's degree in computer science, information security, or a related field.3+ years of experience in penetration testing.OSCP CertificationWeb Application Penetration Experience (Certifications GWEB, eWPTX, or similar)Mobile Application Penetration Experience (Certifications eMAPT, GMOB, or similar)Able to communicate and work well within a Team environment as well as Client-facing experience.If you are interested and meet the qualifications, please share your resume at geeta.bohra@centricconsulting.com or connect with me on LinkedIn.

Experience: 5-8 YearsLocation: HyderabadWeb application penetration testing Expert in running industry standard penetration tools like Burp, OWASP ZAP, SQLMAP Proficient in Linux command line tools Proficient in handling database engines like Oracle and PostgreSQL Robust creativity and problem-solving skills Ability to think analytically Knowledge of technical systems and terminology Proficiency in scripting languagesAbility to identify and exploit vulnerabilities Strong written/verbal communication and interpersonal skills

This position involves performing security vulnerability assessment and penetration testing. Penetration tests will involve a mixture of environments, including network devices, servers, systems, databases and applications that are web-based, server-based and virtual. The successful candidate will work effectively in both individual and team environments. The incumbent must be a self-starter, who is able to contribute to the overall success of the team as well as within other teams. Primary Responsibilities of the Security Specialist I, Global Security Operations Center Role · To perform network, system and application vulnerability assessments and penetration testing.· To do pen-source and commercial testing tools including Kali Linux, Nessus, Metasploit, Nmap, Burp Suite Proxy, Wireshark, Kismet, etc. Additionally, must maintain awareness and knowledge of newly released open-source tools and exploits.· To use various scripting languages such as Python, Perl, PowerShell, Bash, etc.· To analyze identified vulnerabilities to write clear and concise assessment, penetration testing and compliance reports.· To configure, administrate, and troubleshoot Operating Systems including Unix/Linux, Windows, iOS, Android, and the various network devices.· To applies advanced knowledge of concepts, practices, and procedures of IT Security, with awareness of related fields.· Applies analytical and interpretive thinking to complex problems; determines methods /procedures based on professional judgment to achieve desired outcomes. Knowledge, Abilities & Skills Skills/Competencies Knowledge of TCP/IP protocols and networking architectures.Knowledge of databases, applications, and web server design and implementation.Knowledge of security and IT standards, such as PCI DSS v3.0 & NIST SP800.Knowledge of the National Vulnerability Database (NVDB) & the Common Vulnerabilities and Exposures List (CVE). CVE is a dictionary of publicly known information security vulnerabilities and exposures.Excellent time management, written documentation, and oral presentation skills. Experience, Qualifications, Certifications & Travel Minimum Requirements Education: Bachelor’s degree in Information Technology, Computer Science, or related field. Experience may be evaluated in lieu of educational requirements on a case-by-case basis.Experience: (3+ years' experience)· Experience with mobile devices and mobile application security, including secure configuration and tools, techniques, and procedures for security testing.· Experience assessing and testing network devices, including firewalls, routers, VPNs, and switches.· Experience with programming and scripting in C++, Perl, Python, bash, Java and/or Assembly Language (x86).· Experience with TCP/IP including but not limited to HTTP, HTTPS (SSL), DNS, SMTP, MSRPC, RDP and SSH.· Experience with wireless network security, including secure configuration and tools, techniques and procedures for security testing.· Experience with application security, including source code review.· Experience with audit techniques to identify insecure configurations of Windows/Unix/Linux, web servers (Apache, IIS, etc.), databases (MySQL, MSSQL, Oracle, etc.) and web application scripts (PERL, Python, ASP, etc.).· Experience with one or more social engineering test modes (physical, phishing or pre-texting).· Will consider relevant security certifications such as CEH, GIAC, CISSP, GPEN, CEPT, LPT, CPT, OSCP, etc. Travel: None

About AXA:Axa as one of the largest global insurers, our purpose is to act for human progress by protecting what matters. Protection has always been at the core of our business, helping individuals, businesses and societies to thrive. And AXA has always been a leader, an innovator, an entrepreneurial company, fostering progress in all its dimensions. Our purpose also links back to the Group's roots. From the outset, AXA has been committed to acting as a force for collective good. From solidarity-based actions with AXA Hearts In Action to work on prevention issues with the AXA Research Fund and the fight against climate change, AXA has always been attentive to its social environment and embraced its responsibility as an insurer: responsibility for taking action upstream in order to better understand risks, with one goal in mind: to ensure better protection. Our values reflect the culture that the Group’s teams around the world live and express each day. The strength of AXA’s company culture and its outstanding managerial continuity over more than 40 years can also be seen in the proximity of its values across the various periods. Courage, Integrity, One AXA and Customer First are the four core values adopted by the Group since 2016. Our Vision is to transform AXA’s value proposition “from payer to partner”, by delivering new services complementing the traditional insurance coverage and by building new business models to increase the protection of our customers.Mandatory experience:Manual Pentesting of web application, infrastructure, mobile appExtensive knowledge in the areas of information system securityCoding ability (at the very least Python)Recognized credential on a hacking platform: training (HTB, root-me, etc.) or bug bounty (synack, hackerone, etc.)Experience in relevant tools : Burp Suite or equivalent, network discovery, vulnerability scanner, OSINT, exploitation and post-exploitation on web app, OS, infra and mobile application, payload customization, virtualization.Certifications :Offensive security : OSWE, OSCE, OSCP, OSWP, OSEE certificationEC-Council certification (APT, LPT, not CEH)Government sponsored certification : CREST, PASSIDeep knowledge in manual web application penetration testing and payload customizationExpertise in at least one programming languageExperience in working on Linux and Windows environmentCloud environment testing (AWS, Azure)Microsoft certificationCisco certificationISO 27001 certificationCISSPSANS or equivalent certificationPCI DSS certification

About AXA:Axa as one of the largest global insurers, our purpose is to act for human progress by protecting what matters. Protection has always been at the core of our business, helping individuals, businesses and societies to thrive. And AXA has always been a leader, an innovator, an entrepreneurial company, fostering progress in all its dimensions. Our purpose also links back to the Group's roots. From the outset, AXA has been committed to acting as a force for collective good. From solidarity-based actions with AXA Hearts In Action to work on prevention issues with the AXA Research Fund and the fight against climate change, AXA has always been attentive to its social environment and embraced its responsibility as an insurer: responsibility for taking action upstream in order to better understand risks, with one goal in mind: to ensure better protection. Our values reflect the culture that the Group’s teams around the world live and express each day. The strength of AXA’s company culture and its outstanding managerial continuity over more than 40 years can also be seen in the proximity of its values across the various periods. Courage, Integrity, One AXA and Customer First are the four core values adopted by the Group since 2016. Our Vision is to transform AXA’s value proposition “from payer to partner”, by delivering new services complementing the traditional insurance coverage and by building new business models to increase the protection of our customers. Mandatory experience: Manual Pentesting of web application, infrastructure, mobile app Extensive knowledge in the areas of information system security Coding ability (at the very least Python) Recognized credential on a hacking platform: training (HTB, root-me, etc.) or bug bounty (synack, hackerone, etc.) Experience in relevant tools : Burp Suite or equivalent, network discovery, vulnerability scanner, OSINT, exploitation and post-exploitation on web app, OS, infra and mobile application, payload customization, virtualization. Certifications : Offensive security : OSWE, OSCE, OSCP, OSWP, OSEE certification EC-Council certification (APT, LPT, not CEH) Government sponsored certification : CREST, PASSI Deep knowledge in manual web application penetration testing and payload customization Expertise in at least one programming language Experience in working on Linux and Windows environment Cloud environment testing (AWS, Azure) Microsoft certification Cisco certification ISO 27001 certification CISSP SANS or equivalent certification PCI DSS certification

Internal security assessment test hosted by Synclature should be cleared by the candidates.Experience:2-4 yearsGraduate:IT / Computer Science / Electronics & TelecommunicationsCertification (Mandatory):OSCPeJPTSkills:- Sound knowledge of basic IT infrastructure and Linux command line (Debian / Ubuntu / RHEL / CentOS)- Understanding of:virtualization and virtual network administration (configuring and managing Ethernet/IP networks for Windows and Linux virtual machines, and configuringmanaging virtual networks for VMWare, Microsoft Hyper-V, Citrix Xenserver, Linux KVM)network protocol analysis (ARP / ICMP / TCP / UDP / HTTP / HTTPS using TCP dump or Wireshark)concepts like secure coding practice, port scanning, service scanning, enumeration and overall network security assessment- Experience with vulnerability assessment and penetration testing for network /web application/database, vulnerability management and consulting- Knowledge of widely recognized standards and industry frameworks such as OWASP, SANS, NIST etc.- Knowledge or experience of security operational activities, IT security architecture, Firewall Rules, IDS/IPS- Self-learner: ability to keep oneself updated with the latest threats and vulnerabilities discovered- Good verbal and written communication skillsDuties:- Vulnerability assessment and penetration testing of:NetworksMobile Apps (Android and iOS)Web Apps and API testingSource Code ReviewCloud Security- Robot testing- Conduct research on latest tools and technologies to derive innovative testing methodologies- Stay updated with the latest threats, vulnerabilities and security standards such as OWASP, WASC, SANS, etc.- Reporting and documentation- Deliver presentation to executive management and technical teams

Job Summary:Client is seeking a Penetration Tester to sit either Delhi/Bangalore to and support a large company going through a divestiture. We are looking for a senior PenTester to work within a cloud environment (GCP and Azure) to help customers generate and scope test requirements for tracking remediation using tools like Burp suite, Metasploit, Nmap/Zenmap, SQLMap, Kali Linux, Tenable/Nessus. He/She must have knowledge in powershell scripting to understand from the applications team point of view if conflict was to arise and ability to use power BI to generate reports.Responsibilities:Infrastructure Assessment: The Penetration Tester will analyze a variety of systems within Experian, spanning from external-facing applications to internal networks or cloud environments, ensuring all potential vectors of attack are considered.Regular Deliverables: Meeting targets is crucial. Delivering a minimum workload per month is a clear metric of productivity, yet it's vital this doesn't come at the expense of the assessment's depth or quality.Strategic Testing: Under the guidance of senior team members, the Penetration Tester will work to determine which systems to test, based on current risk assessments and business needs.Standards Adherence: While conducting tests, it's essential to follow industry best practices and our in-house SOPs, ensuring consistent and rigorous assessments.Skill Development: Continual learning is encouraged. While proficiency in basic scripting and understanding of various environments is required, there will be opportunities to expand on these skills and learn new techniques.Clear Communication: The ability to relay findings, both to the cybersecurity team and potentially to broader stakeholders, is essential. Clear, concise reporting ensures swift action can be taken on any vulnerabilities found.Team Collaboration: Being a valuable team player is vital. While the Penetration Tester will work on individual projects, collaboration, sharing insights, and integrating feedback are all crucial aspects of the role.Required:-5+ years of relevant experience in Security and Penetration Testing-Experience with Burp suite, Metasploit, Nmap/Zenmap, SQLMap, Kali Linux, and/or Tenable/Nessus-Strong understanding of security frameworks including OWSAP, SANS, CIS, NIST-Experience working in Azure Cloud environments-Powershell scripting skills-Power BI experience preferred-Certifications in Cpent, OSCP, CPE, and/or AZ-500 preferred

Internal security assessment test hosted by Synclature should be cleared by the candidates.Experience:2-4 yearsGraduate:IT / Computer Science / Electronics & TelecommunicationsCertification (Mandatory):OSCPeJPTSkills:- Sound knowledge of basic IT infrastructure and Linux command line (Debian / Ubuntu / RHEL / CentOS)- Understanding of:virtualization and virtual network administration (configuring and managing Ethernet/IP networks for Windows and Linux virtual machines, and configuringmanaging virtual networks for VMWare, Microsoft Hyper-V, Citrix Xenserver, Linux KVM)network protocol analysis (ARP / ICMP / TCP / UDP / HTTP / HTTPS using TCP dump or Wireshark)concepts like secure coding practice, port scanning, service scanning, enumeration and overall network security assessment- Experience with vulnerability assessment and penetration testing for network /web application/database, vulnerability management and consulting- Knowledge of widely recognized standards and industry frameworks such as OWASP, SANS, NIST etc.- Knowledge or experience of security operational activities, IT security architecture, Firewall Rules, IDS/IPS- Self-learner: ability to keep oneself updated with the latest threats and vulnerabilities discovered- Good verbal and written communication skillsDuties:- Vulnerability assessment and penetration testing of:NetworksMobile Apps (Android and iOS)Web Apps and API testingSource Code ReviewCloud Security- Robot testing- Conduct research on latest tools and technologies to derive innovative testing methodologies- Stay updated with the latest threats, vulnerabilities and security standards such as OWASP, WASC, SANS, etc.- Reporting and documentation- Deliver presentation to executive management and technical teams

Job Requirements:

• Hands on experience in Application Security Testing : Vulnerability Assessment, Secure Code review
• Expertise in web application Security Testing, API Security Testing
• Hands on experience in tools like BurpSuite, Kali Linux etc
• OWASP top 10
• OWASP Secure Coding
• Proven expertise in manual penetration and exploitation skills for vulnerabilities
• Good technical presentation skills and Team collaboration skills are a must.
• Security Certifications like CEH
• Expertise in Cyber Security standards like OWASP, NIST, SANS etc
• Hall of Fame / Bug Bounty experience

Key Responsibilities: 

• Perform manual Security Testing using tools like BurpSuite, Kali Linux.
• Prepare and send detailed Reports of the vulnerabilities found on a weekly basis
• Keep up with the latest methods for ethical hacking and testing.
• Conduct API Penetration Testing
• Conduct Source Code reviews for security vulnerabilities
• Training for Devs / QA about security vulnerabilities
• Creating documents that will guide the functional QAs to do VAPT 
• Create guidelines for future projects to avoid vulnerabilities

Skills:- security testing,, Vulnerability assessment, OWASP,, Cyber Security,, NIST, and manual security testing