API Pentester

Join our Offensive Security team and lead penetration testing engagements for clients across financial services, technology, healthcare, government, and critical infrastructure sectors. This is a hands-on role for an experienced security professional who wants to remain highly technical while taking ownership of project delivery, client relationships, and mentoring junior consultants.

Key Responsibilities:
• Lead and perform penetration tests across web applications, APIs, internal/external networks, mobile applications, cloud environments, and Active Directory.
• Conduct advanced Active Directory security assessments and infrastructure testing.
• Develop custom scripts, tooling, and proof-of-concept exploits.
• Manage engagements from scoping to reporting and remediation validation.
• Present findings to technical and business stakeholders.
• Support proposal development, effort estimation, and pre-sales activities.
• Mentor junior team members and contribute to internal methodologies and best practices.

Required Experience:
• 5+ years of hands-on penetration testing or offensive security experience, ideally within a consulting environment.
• Strong expertise in at least three of the following: web, network, mobile, or Active Directory security testing.
• Experience with tools such as Burp Suite, Nmap, Metasploit, BloodHound, Impacket, Cobalt Strike (or similar), Nessus/OpenVAS, Frida, and MobSF.
• Scripting skills in Python, PowerShell, or Bash.
• Strong communication, reporting, and client-facing skills.

Certifications:
At least one of:
• OSCP
• CREST CRT/CPSA
• CRTP or CRTO

Nice to Have:
• Big 4 or cybersecurity consultancy experience.
• Cloud security testing (AWS, Azure, GCP).
• Kubernetes/container security knowledge.
• Security research, CVEs, conference talks, or CTF achievements.

Offer:
• Multisport Card
• Life insurance
• Private healthcare
• PowerYou platform