We're looking for a security pentester to test web applications and APIs, networks and /Active Directory environments. You'll run standard assessments independently, with senior support for complex work.
What you'll do
- Conduct across web, network and /Active Directory environments.
- Define assessment scope and rules of engagement with a senior.
- Write reproducible vulnerability reports with evidence, impact, risks and recommendations.
- Present findings to technical teams and project leads.
- Retest fixes to validate remediation.
- Escalate critical findings and scope uncertainties to a senior.
What you bring
- At least eight years of practical experience.
- Structured black-box, grey-box and white-box testing, controlled exploitation and post-exploitation.
- Web/API testing: injections, IDOR, XSS, SSRF, deserialisation and session/token management.
- 2.0, , SAML, JWT and targeted code review.
- Network testing: , DNS//NTP/SNMP, HTTP/HTTPS/TLS, SMB//Kerberos/RDP/WinRM, VPN, segmentation and filtering.
- /Active Directory: domain enumeration, GPO, ACL, Kerberos/NTLM, lateral movement and .
- WSTG/ASVS/API Security Top 10, PTES, MITRE ATT&CK and CVSS.
- /Parrot, Suite/ ZAP, Nmap/Wireshark/Nessus and Metasploit/Impacket/NetExec.
- Higher degree in IT, or telecommunications, or equivalent professional experience.
- , B2.
- , B2.
- , B2.
Nice to have
- /OSCP+, Certified Practitioner (BSCP) or CRTP certification.
- Knowledge of cloud (/AWS/GCP), , containers, and .
What's next?
The people who do well here are the ones who saw themselves in this description. Not because they match every line, but because the mission felt right for them.
We are actively hiring for this position. Applications are reviewed by our team, and matching profiles receive a call to discuss the role in detail.
It takes under a minute to apply. Your email, your CV. That is all we need to start the conversation.