Sr. Penetration Tester

 

• Lead the technical review and quality assurance of automated internal and external network vulnerability and penetration testing reports, identifying systemic gaps, false positives/negatives, and complex attack paths requiring advanced validation.

• Design, execute, and document advanced exploitation and post-exploitation techniques not covered by the automated penetration testing platform, including multi-step attack chains and privilege escalation paths.

• Serve as a subject-matter expert for exploitation methodologies, providing actionable feedback, bug reports, and architectural improvement recommendations to the automation and engineering teams.

• Define, document, and maintain a knowledge base of exploitation and post-exploitation techniques, ensuring consistency, repeatability, and alignment with real-world attacker behavior.

• Partner closely with the automation team to identify, model, and formalize attacker vectors not yet supported by the platform, translating manual techniques into automation-ready logic.

• Design, develop, and maintain custom tooling to support exploitation, post-exploitation, and reporting workflows, with an emphasis on reliability, scalability, and reusability.

• Develop and maintain automation scripts and proof-of-concept exploits (Ruby, Python, Bash) to eliminate repetitive manual testing, validate complex attack scenarios, and extend platform capabilities.

• Drive continuous improvement of the pentest QA process by proposing new procedures, tooling, and standards that increase accuracy, reduce noise, and improve signal quality in assessment outputs.

• Act as a technical mentor and reviewer for less-experienced pentesters, raising overall quality and consistency of exploitation and reporting practices.

---

Qualifications (Senior)

• 3+ years of hands-on network security and penetration testing experience in a professional environment, with demonstrated depth in exploitation and post-exploitation.

• Strong mastery of network security fundamentals and attacker tradecraft, including exploitation of common enterprise protocols such as SMB, Kerberos, LDAP, FTP, Telnet, SSH, SMTP, RDP, and NFS.

• Deep understanding of network and web protocols, including TCP/IP, UDP, IPSEC, HTTP/HTTPS, and routing concepts, with the ability to identify subtle misconfigurations and abuse paths.

• Extensive experience with industry-standard penetration testing tools, such as Kali Linux, Metasploit, Burp Suite, Impacket, CrackMapExec, Responder, BloodHound, Mimikatz, Kerbrute, and similar frameworks.

• Proven expertise in Active Directory security assessments, including enumeration, privilege escalation, lateral movement, and domain compromise techniques.

• Strong programming and scripting skills, with Ruby or Python proficiency preferred; ability to rapidly prototype tools, exploits, and automation.

• Advanced experience with Unix/Linux systems, shell environments, and scripting (sh, bash, zsh).

• Demonstrated ability to think like an attacker, prioritize risk, and translate complex technical findings into actionable insights for engineering and automation teams.