Web Application Penetration Tester – Cybersecurity Remote

Job Description: • Conduct penetration testing, ethical hacking, and security assessments on web applications, networks, cloud infrastructures (AWS, Azure, GCP), and enterprise IT environments. • Identify and exploit vulnerabilities such as SQL Injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), and Insecure Direct Object References (IDOR). • Perform network security assessments, including port scanning, vulnerability analysis, privilege escalation, and Active Directory (AD) security testing. • Utilize cybersecurity tools such as Burp Suite, Metasploit, Nmap, Wireshark, Nessus, Acunetix, Kali Linux, and BloodHound for in-depth security evaluations. • Develop and execute custom scripts, automation tools, or exploits for penetration testing scenarios. • Conduct post-exploitation analysis, privilege escalation, and persistence techniques. • Provide detailed security reports, risk assessments, remediation plans, and mitigation strategies to enhance security posture. • Stay updated on zero-day vulnerabilities, exploit development, cloud security threats, and emerging cyberattack techniques.

Requirements: • Hands-on experience in penetration testing, web security, vulnerability assessments, and red teaming. • Strong understanding of ethical hacking methodologies including OSSTMM, OWASP Top 10, PTES, NIST, MITRE ATT&CK, and CIS Benchmarking. • Proficiency in web application security testing, cloud security (AWS, Azure, GCP), and API security. • Experience in network security, firewall evasion, social engineering, and Wi-Fi security testing. • Knowledge of reverse engineering, malware analysis, exploit development, and buffer overflow techniques is a plus. • Familiarity with Active Directory attacks, Kerberoasting, Pass-the-Hash, Mimikatz, BloodHound, and PowerShell Empire is highly desirable. • Proficiency in scripting/programming (Python, Bash, PowerShell, JavaScript, or C) for security automation and exploit development. • Relevant certifications such as OSCP, OSCE, OSEP, CRTP, CEH, GPEN, CISSP, eWPTX, or GXPN are highly preferred.

Benefits: