Intermediate Pentester; Code Review

Location: Cape Town or Johannesburg, South Africa
Employment type: Full time, permanent
Seniority: Intermediate - three to four years in security

• Source code review is a must for this seat, not an add-on to a pentest. You read the code, follow the change history and find the flaw in the logic.
• Offensive experience and code-reading ability are both required.

Red Herd is a specialist cybersecurity recruitment and advisory firm. We work with consultancies, product companies, vendors and enterprise security teams across South Africa, the UK, Europe and the United States. We are recruiting this position exclusively on behalf of our client. Their identity is shared with you during qualification, before anything is submitted. We never introduce your profile without your knowledge and consent.

A deeply technical security review and consulting firm working with global clients. Their differentiator is depth: where most firms stop at a penetration test, this team goes into the source code, traces how a vulnerability was introduced across versions, and works with the client's engineers to fix it.

Consultants are staffed onto client engagements rather than kept on internal product work, so the codebases and the languages change from project to project. The team is small enough that a consultant's own judgement carries real weight on an engagement.

You review source code for security defects and work with the client engineering teams. That means reading unfamiliar codebases quickly, following commit history and diffs to understand how a change introduced or resolved a flaw, identifying the affected functions and logic paths, and proving the impact. The work is code-review led, with penetration testing alongside it.

It is not a scanner-driven assurance seat and it is not a report-assembly role. Findings must be real, demonstrated, and explained well enough that an engineer can act on them. It is not a senior or management position either. This is a hands-on individual contributor seat, though intermediate consultants here are expected to help junior reviewers find their feet.

• Review source code for security defects across unfamiliar client codebases.
• Follow commit histories and code diffs to understand how a vulnerability was introduced, and whether a fix actually closed it.
• Identify the affected functions, dependencies and logic paths behind a finding.
• Analyse published CVEs and their patches, and look for the same pattern elsewhere in the code.
• Validate findings and demonstrate real impact rather than reporting theoretical risk.
• Carry out penetration testing and security assessment work alongside the review work.
• Produce clear, well-structured written findings that a client engineer can act on.
• Explain a finding and its remediation directly to the client's technical team.
• Get up to speed on an unfamiliar language, framework or codebase at the start of an engagement.
• Support and guide junior reviewers on the same engagement.

Around three to four years in security, with real time spent in penetration testing or offensive security.

• Hands-on source code review for security defects. This is the must-have for this seat. You have found real vulnerabilities by reading code, not only by running static analysis tooling.
• The ability to read and reason about source code in at least one compiled or JVM language, on a codebase you have never seen before.
• Comfort in Git-based repositories
  , reading commit history and diffs.
• Demonstrated offensive ability. You have found and proven real vulnerabilities, and you can walk through how.
• Strong written English and genuine report-writing skill. The written finding is the deliverable.
• The ability to explain a technical finding to the engineers who own the code.
• South African work authorisation that you already hold.

Each one strengthens an application.

• C or C++, or other low-level code.
• Java or Scala.
• Static analysis and code property graph tooling.
• A software development background before moving into security.
• Vulnerability research or exploit development.
• Responsible disclosure, bug bounty or CTF results.
• Public research, technical write-ups or conference talks.
• A computer science degree or equivalent formal qualification.

Based in Cape Town or Johannesburg.

Engagement-based work with global clients, so some overlap in working hours with client time zones is expected.

The exact office and…