Senior Penetration Tester

We are seeking an experienced Senior Penetration Tester to conduct comprehensive security assessments across web applications, internal and external infrastructure, Active Directory environments, and client-server applications. The ideal candidate should have strong expertise in application security testing, source code analysis, SAST/DAST, network penetration testing, OSINT, and identifying and exploiting security vulnerabilities.

The candidate will be responsible for assessing security risks, validating vulnerabilities, recommending remediation measures, and preparing detailed technical reports to strengthen the organization’s overall security posture.

• Conduct penetration testing of web applications, APIs, and other application environments.
• Perform application security assessments using SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools.
• Conduct manual source code reviews to identify security flaws, insecure coding practices, and potential vulnerabilities.
• Perform internal and external network penetration testing to identify vulnerabilities and assess potential attack paths.
• Conduct Active Directory security assessments
  , including enumeration, privilege escalation, misconfiguration analysis, and attack path identification.
• Perform penetration testing of thick-client and thin-client applications, including client-server communication and authentication mechanisms.
• Conduct Open-Source Intelligence (OSINT) activities to identify publicly exposed assets, information leakage, and potential attack surfaces.
• Identify, validate exploit, and document security vulnerabilities while following authorized testing procedures.
• Assess authentication, authorization, session management, access controls, and common application security weaknesses.
• Use industry-standard penetration testing tools and methodologies to perform security assessments.
• Prepare detailed penetration testing reports, including findings, risk ratings, proof of concept, business impact, and remediation recommendations.
• Work closely with development, infrastructure, and security teams to validate findings and support vulnerability remediation.
• Perform retesting to verify that identified vulnerabilities have been appropriately resolved.
• Follow recognized security standards and methodologies, including OWASP, PTES, and relevant MITRE ATT&CK techniques.

• Application Security: Web application and API penetration testing, OWASP Top 10, authentication and authorization testing.
• SAST/DAST: Experience with security testing tools and interpretation of scan results.
• Source Code Analysis: Ability to review source code and identify security vulnerabilities.
• Active Directory: AD enumeration, privilege escalation, Kerberos-related attacks, misconfiguration analysis, and lateral movement techniques.
• Internal & External Penetration Testing: Network enumeration, vulnerability assessment, exploitation, and attack path analysis.
• Thick & Thin Client Testing: Experience assessing client-server applications, business logic, and communication protocols.
• OSINT: Publicly exposed asset discovery, reconnaissance, and information gathering.
• Reporting: Strong technical documentation, risk assessment, and remediation guidance skills.

Experience with relevant tools such as:

• Application Security: Burp Suite Professional, OWASP ZAP, Postman.
• SAST/DAST: Sonar Qube, Checkmarx, Fortify, Veracode, or equivalent tools.
• Network Penetration Testing: Nmap, Nessus, Metasploit.
• Active…