Penetration Tester (Offensive Security)

About the role

Uni Systems is looking for a Penetration Tester to join its UniQue Offensive Security and Assurance Unit. The role covers internal and external infrastructure testing, web and API testing, vulnerability assessments and client reporting, with occasional travel abroad (about 5% of working time).

Key responsibilities

• Perform internal and external infrastructure penetration testing of networks, systems and Active Directory environments.
• Conduct web application and API penetration testing using black-box, grey-box and white-box approaches.
• Carry out vulnerability assessments, analyse scan results, manually validate vulnerabilities and perform controlled exploitation where appropriate.
• Take part in security source code reviews to find vulnerabilities and insecure coding practices.
• Prepare penetration testing and vulnerability assessment reports with findings, evidence, risk assessment and remediation recommendations.
• Re-test to confirm that vulnerabilities have been fixed and explain their technical and business impact to clients.
• Develop or customise scripts and tools, and follow the agreed scope, methodology and Rules of Engagement.
• Support specialised engagements such as Red Team operations, mobile app testing and social engineering assessments.

Required profile

• University degree in Information Security, Computer Science, Information Technology or a related field, or equivalent practical experience.
• 3+ years of hands-on experience in penetration testing or offensive security.
• Hands-on experience in web application/API or infrastructure testing, with working knowledge of the other area.
• Experience in vulnerability assessments, manual testing and exploitation.
• Good knowledge of Windows, Linux, networking and Active Directory security.
• Excellent written and spoken English; flexibility to travel abroad mainly in EU countries.

Required skills

• OWASP Top 10, OWASP API Security Top 10, OWASP WSTG and PTES.
• Burp Suite, Nmap, Metasploit, Nessus or equivalent.
• Scripting and automation in Python, Bash, PowerShell or similar.
• Firewalls, IDS/IPS, WAFs and VPNs.
• Assets: OSCP, CEH, CPTS, PNPT, eCPPT, eWPT, CREST, GPEN, GWAPT, BSCP, CRTO, Red Team, mobile app or social engineering experience, cloud security (Azure/AWS), Master's degree.

What we offer

• Hybrid work model and work-life balance.
• Continuous training and development.
• Ticket restaurant, corporate laptop, mobile phone subscription and health and insurance plan for you and your family.
• Employee consulting, discounts on group company services and gift vouchers.
• Special work schedule on summer Fridays and birthdays.