Cybersecurity and Penetration Tester

Our client is seeking a highly skilled and detail-oriented Cybersecurity & Penetration Tester to strengthen its security posture by proactively identifying, assessing, and mitigating vulnerabilities across applications, networks, cloud environments, and enterprise systems. The successful candidate will be responsible for conducting authorized penetration tests, vulnerability assessments, security audits, and red team exercises while providing actionable recommendations to improve the organization's overall cybersecurity resilience.

The ideal candidate is passionate about offensive security, stays current with emerging threats and attack techniques, and possesses hands-on experience with ethical hacking methodologies, security frameworks, and modern penetration testing tools.

• Conduct authorized penetration tests on web applications, mobile applications, APIs, cloud environments, wireless networks, and internal/external infrastructure.
• Perform black-box, grey-box, and white-box penetration testing engagements.
• Simulate real-world cyberattacks to identify exploitable vulnerabilities.
• Execute red team exercises to assess the effectiveness of security controls and incident response capabilities.
• Validate remediation efforts through follow-up testing.

• Perform regular vulnerability assessments across enterprise systems and infrastructure.
• Identify, prioritize, and document security weaknesses based on business risk.
• Work closely with infrastructure, development, and operations teams to ensure timely remediation.
• Monitor emerging vulnerabilities and recommend proactive mitigation measures.

• Conduct security reviews of applications, cloud platforms, operating systems, databases, and network environments.
• Assess security configurations against industry best practices and compliance standards.
• Review firewall, VPN, endpoint, identity management, and access control configurations.
• Participate in secure architecture and design reviews.

• Perform application security testing during the Software Development Life Cycle (SDLC).
• Conduct Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Assess APIs and microservices for authentication, authorization, and data security vulnerabilities.
• Collaborate with software developers to implement secure coding practices.

• Support cyber incident investigations by identifying attack vectors and exploited vulnerabilities.
• Assist with digital forensic activities where required.
• Provide recommendations to strengthen detection and prevention capabilities following security incidents.

• Prepare comprehensive penetration testing reports with technical findings, business impact assessments, proof of concept, and remediation recommendations.
• Present findings to both technical teams and business stakeholders.
• Maintain documentation of testing methodologies, tools, and results.
• Develop executive summaries suitable for management and clients.

• Support compliance initiatives related to ISO 27001, PCI DSS, NIST, CIS Controls, GDPR, and other applicable standards.
• Conduct security risk assessments and recommend appropriate mitigation strategies.
• Participate in internal and external security audits.

• Stay informed about emerging cyber threats, attack techniques, vulnerabilities, and security technologies.
• Research and evaluate new penetration testing tools and methodologies.
• Develop and maintain internal testing scripts and automation tools where appropriate.
• Contribute to the continuous improvement of the organization's cybersecurity programme.

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related discipline.
• A Master's degree is an added advantage.

• Minimum of 3–5 years of hands-on experience in penetration testing, ethical hacking, or offensive cybersecurity.
• Experience conducting penetration testing across web applications, infrastructure, cloud environments, APIs, and wireless networks.
• Experience working within Security Operations, Cybersecurity Consulting, or Information Security teams.
• Familiarity with secure software development practices and cloud security concepts.

The ideal candidate should possess experience in:

• Web Application Penetration Testing
• Network Penetration Testing
• Mobile Application Security Testing
• API Security Testing
• Wireless Security Testing
• Cloud Security Assessments
• Active Directory Security Assessments
• Red Team Operations