Web Application Penetration Tester

Key Responsibilities:

• Conduct penetration testing, ethical hacking, and security assessments on web applications, networks, cloud infrastructures (AWS, Azure, GCP), and enterprise IT environments.

• Identify and exploit vulnerabilities such as SQL Injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), and Insecure Direct Object References (IDOR).

• Perform network security assessments, including port scanning, vulnerability analysis, privilege escalation, and Active Directory (AD) security testing.

• Utilize cybersecurity tools such as Burp Suite, Metasploit, Nmap, Wireshark, Nessus, Acunetix, Kali Linux, and BloodHound for in-depth security evaluations.

• Develop and execute custom scripts, automation tools, or exploits for penetration testing scenarios.

• Conduct post-exploitation analysis, privilege escalation, and persistence techniques.

• Provide detailed security reports, risk assessments, remediation plans, and mitigation strategies to enhance security posture.

• Stay updated on zero-day vulnerabilities, exploit development, cloud security threats, and emerging cyberattack techniques.

Qualifications & Skills:

• Hands-on experience in penetration testing, web security, vulnerability assessments, and red teaming.

• Strong understanding of ethical hacking methodologies including OSSTMM, OWASP Top 10, PTES, NIST, MITRE ATT&CK, and CIS Benchmarking.

• Proficiency in web application security testing, cloud security (AWS, Azure, GCP), and API security.

• Experience in network security, firewall evasion, social engineering, and Wi-Fi security testing.

• Knowledge of reverse engineering, malware analysis, exploit development, and buffer overflow techniques is a plus.

• Familiarity with Active Directory attacks, Kerberoasting, Pass-the-Hash, Mimikatz, BloodHound, and PowerShell Empire is highly desirable.

• Proficiency in scripting/programming (Python, Bash, PowerShell, JavaScript, or C) for security automation and exploit development.

• Relevant certifications such as OSCP, OSCE, OSEP, CRTP, CEH, GPEN, CISSP, eWPTX, or GXPN are highly preferred.