Cyber Penetration Tester

About the role

We are looking for an experienced Cyber Penetration Tester to lead and execute advanced manual security assessments across web, mobile, API, and network environments. This role requires deep offensive security expertise and effective communication of technical findings to diverse stakeholders.

Key responsibilities

• Lead technical scoping and execution of penetration testing engagements based on business needs and risk assessments.
• Perform manual penetration tests on web applications, mobile platforms (Android & iOS), APIs, networks, and thick client applications.
• Identify and validate vulnerabilities, distinguishing exploitable issues from false positives, and provide risk-based remediation guidance.
• Prepare detailed technical reports and executive summaries highlighting security risks and recommended mitigations.
• Contribute to improving testing methodologies and leverage automation and AI-assisted tools to enhance coverage and efficiency.

Required skills and experience

• 5–8 years of hands-on experience in manual penetration testing of web, mobile, API/web services, and network environments.
• Strong knowledge of common vulnerabilities and exploitation techniques aligned with OWASP Top 10, API Security, and MITRE ATT&CK frameworks.
• Proficient with security testing tools including Burp Suite, OWASP ZAP, Metasploit, SQLMap, Nmap, Postman, Swagger, and Kali Linux.
• Working knowledge of scripting languages such as Python, Bash, or PowerShell to support automation and exploit development.
• Excellent analytical, troubleshooting, and communication skills with the ability to explain complex vulnerabilities to technical and non-technical audiences.
• Experience working in fast-paced, collaborative global delivery environments with multiple stakeholders.

Nice to have

• Exposure to AI-enabled application security testing including LLM security and prompt injection scenarios.
• Experience with reverse engineering, cloud security assessments, and SAST/DAST tools.
• Familiarity with secure coding practices and remediation validation.
• Relevant industry certifications such as OSCP, OSWE, OSEP, GPEN, GWAPT, GMOB, or eCPPT.

Location

Hyderabad, Telangana, India (Hybrid)