API Pentester

Join our Offensive Security team and lead penetration testing engagements for clients across financial services, technology, healthcare, government, and critical infrastructure sectors. This is a hands-on role for an experienced security professional who wants to remain highly technical while taking ownership of project delivery, client relationships, and mentoring junior consultants.

Key Responsibilities:

• Lead and perform penetration tests across web applications, APIs, internal/external networks, mobile applications, cloud environments, and Active Directory.

• Conduct advanced Active Directory security assessments and infrastructure testing.

• Develop custom scripts, tooling, and proof-of-concept exploits.

• Manage engagements from scoping to reporting and remediation validation.

• Present findings to technical and business stakeholders.

• Support proposal development, effort estimation, and pre-sales activities.

• Mentor junior team members and contribute to internal methodologies and best practices.

Required Experience:

• 5+ years of hands-on penetration testing or offensive security experience, ideally within a consulting environment.

• Strong expertise in at least three of the following: web, network, mobile, or Active Directory security testing.

• Experience with tools such as Burp Suite, Nmap, Metasploit, BloodHound, Impacket, Cobalt Strike (or similar), Nessus/OpenVAS, Frida, and MobSF.

• Scripting skills in Python, PowerShell, or Bash.

• Strong communication, reporting, and client-facing skills.

Certifications:
At least one of:

• OSCP

• CREST CRT/CPSA

• CRTP or CRTO

Nice to Have:

• Big 4 or cybersecurity consultancy experience.

• Cloud security testing (AWS, Azure, GCP).

• Kubernetes/container security knowledge.

• Security research, CVEs, conference talks, or CTF achievements.

Offer:

• Multisport Card

• Life insurance

• Private healthcare

• PowerYou platform