Penetration Tester Job Description Template

In order to maintain the security of our network and systems, we are seeking an experienced Penetration Tester to conduct offensive cyber operations across the organization. In this role, you will emulate adversarial tactics and procedures to test our detective and preventive response controls across our global technology landscape. In addition, you will use your security expertise to influence technology decisions, in collaboration with our broader IT, security, and leadership teams.

Typical Duties and Responsibilities

• Scope and execute complex offensive security operations testing on networks and applications to identify vulnerabilities
• Conduct physical assessments of server systems and network device security
• Conduct security and network audits to identify and address potential vulnerabilities
• Collaborate with defensive operations teams to guide and mature cyber defensive countermeasures
• Develop scripts, tools, and methodologies to enhance the organization’s penetration testing processes
• Review organization security policies and make suggestions to improve their effectiveness
• Document identified security weaknesses with security assessment reports and discuss solutions with IT teams and leadership
• Provide recommendations and guidance to key security stakeholders to close identified security gaps

Education

• Bachelor’s degree in computer science, cybersecurity, IT, or a related field

Required Skills and Experience

• 4+ years of experience in an IT or technology related role
• 2+ years of experience in security principles, such as attack frameworks, threat landscapes, and ethical hacker tactics, techniques, and procedures
• Experience conducting security assessments across a variety of technology stacks and architectural implementations
• Experience in network penetration testing, web application penetration testing, and/or network infrastructure manipulation
• Experience with shell scripting or automation using Perl, Python, or Ruby
• Experience with operating system and application security hardening best practices
• Knowledge of reverse engineering malware, ciphers, or data obfuscators
• Knowledge of source code review for security flaws and control flow
• Knowledge of developing applications in C#, ASP, .NET, Java, Go, or Objective C
• Knowledge of tools used for wireless, web application, and network security testing
• Understanding of network protocols
• Understanding of Unix, Linux, Windows, and Mac operating systems, including bash and PowerShell
• Ability to document and explain technical concepts to both technical and non-technical audiences

Preferred Qualifications

• Professional certification such as GPEN, CEH, OSCP, CISSP, and/or GWAPT