SecuritySMBEnterprise

Penetration Tester / Ethical Hacker

[Company Name] is seeking a Penetration Tester to proactively identify security vulnerabilities in our applications, infrastructure, and cloud environments. You will conduct authorized attack simulations, write detailed findings reports, and work with engineering teams to validate remediations. This role is ideal for a creative, methodical security professional who enjoys thinking like an adversary to protect our users and data.

Download DOCXUse in AtinoHire

Key Responsibilities

  • Conduct web application, API, and network penetration tests against production and staging environments
  • Perform cloud infrastructure security assessments across AWS, Azure, or GCP environments
  • Write clear, actionable penetration test reports with risk ratings and remediation guidance
  • Collaborate with development teams to validate that remediations effectively resolve identified vulnerabilities
  • Research emerging attack techniques, CVEs, and exploit chains to keep testing methodologies current
  • Participate in red team exercises and adversary simulation campaigns
  • Contribute to the development of internal security testing tools and automation

Required Skills & Experience

  • 3+ years of experience in penetration testing or offensive security roles
  • Strong knowledge of web application vulnerabilities (OWASP Top 10) and exploitation techniques
  • Proficiency with penetration testing tools such as Burp Suite, Metasploit, and Nmap
  • Experience with scripting for custom exploits and automation (Python, Bash, or PowerShell)
  • Understanding of networking protocols, common misconfigurations, and privilege escalation techniques
  • Ability to write clear, professional penetration test reports for both technical and executive audiences
  • Familiarity with cloud security assessment methodologies

Nice-to-Have

  • Relevant certifications (OSCP, GPEN, GWAPT, or CRTO)
  • Experience with mobile application penetration testing (iOS and Android)
  • Knowledge of Active Directory attack paths and Kerberos exploitation
  • Contributions to bug bounty programs or published CVEs
  • Experience with container and Kubernetes security testing

Tech Stack

Burp Suite ProfessionalMetasploitNmapCobalt StrikeBloodHoundKali LinuxPythonWiresharkNuclei

What We Offer

  • Competitive salary and equity package
  • Flexible remote or hybrid work arrangement
  • Health, dental, and vision insurance
  • Annual learning and development budget
  • Generous PTO policy

Interview Process

  1. 1Recruiter phone screen (30 min) — role fit and logistics
  2. 2Technical phone screen (45 min) — security fundamentals and methodology discussion
  3. 3Practical exercise — conduct a time-boxed penetration test on a deliberately vulnerable application
  4. 4Report review — present findings and remediation recommendations to the security team
  5. 5On-site or virtual final round (2 hours) — red team scenario discussion and team fit
  6. 6Offer and reference checks

Hiring for this role? You might also need:

Interview Scorecards

Phone Screen

Recruiter Phone Screen (Universal)

General-purpose recruiter screen covering motivation, experience fit, and logistics.

Hiring Manager

Hiring Manager Final Round

Final evaluation by hiring manager: team fit, role alignment, and leadership potential.

Culture & Values

Culture & Values Interview

Behavioral interview scorecard covering collaboration, ownership, and growth mindset.

Email Templates

Sourcing

Cold Outreach — Passive Developer

A personalized first-touch email to engage passive developers who aren't actively job hunting.

Sourcing

Cold Outreach Follow-up

A concise follow-up email for candidates who didn't respond to your initial outreach.

Sourcing

Cold Outreach — Break-up Email

A final follow-up email that politely closes the outreach sequence while leaving the door open.

Related Templates

Security

Application Security Engineer (AppSec)

A job description template for hiring application security engineers who integrate security into the software development lifecycle through code review, threat modeling, and secure coding practices.

Security

Security Analyst / SOC Analyst

A job description template for hiring security analysts and SOC analysts who monitor, detect, and respond to security threats and incidents across the organization.

Security

Cloud Security Engineer

Secure cloud infrastructure by designing IAM policies, hardening configurations, and automating compliance monitoring.

Back to all templates