Ethical hacker

• Plan and conduct authorized security assessments across a diverse range of technologies, systems, and environments
• Lead intake: clarify objectives, identify dependencies, define scope, select an appropriate test approach, and agree with rules of engagement with relevant stakeholders
• Produce clear technical reports and executive-ready summaries that explain evidence, impact, root cause and practical remediation options
• Present findings to technical and non-technical stakeholders, align corrective actions, and perform re-assessments to verify remediation effectiveness
• Collaborate with developers, engineers, and security stakeholders to identify, prioritize, and remediate security risks, while maintaining the independence and objectivity of security assessments
• Improve testing methodologies, automation, knowledge assets, tooling and service processes; share lessons learned and contribute to team capability development. Share security knowledge and real-world insights by creating and delivering awareness content, training, and workshops that promote a strong security culture across the organization.

We are looking for experienced pentesters who can work independently, make sound technical judgments, and communicate risks clearly.

• 3+ years of experience in penetration testing, ethical hacking, or a closely related offensive security role
• Familiarity with testing web applications, thick clients, VDIs, APIs, web services, AI, and performing source code reviews in multiple programming languages
• Threat modeling and architecture reviews with software solutions is a plus
• Experience testing GenAI applications and LLM models
• A degree in cybersecurity, computer science, engineering or a related technical discipline is preferred; equivalent professional experience is also valued
• Preferred certifications: Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN) or comparable hands-on penetration testing certification; Offensive Security Web Expert (OSWE), GIAC Web Application Penetration Tester (GWAPT) or comparable application security certification; Certified Red Team Operator (CRTO), Certified Red Team Professional (CRTP) or comparable red teaming / adversary emulation certification; relevant SANS, cloud, mobile, OT/ICS or product security training and certifications, * Depth in one or more core domains: web, infrastructure, cloud security testing
• Programming experience in one or more languages
• Ability to validate findings manually, reason over attack paths, and avoid overreliance on automated tooling
• Good time management skills; the ability to commit and adhere to time-sensitive deliverables
• Clear communication with both technical and non-technical stakeholders
• Ability to conduct scoping and closure meeting calls, be the main point of contact, lead report generation activities, and be the main interface with stakeholders on security assessments
• Nice to have: AI/LLM security testing, OT/ICS security, product security, reverse engineering, hardware security, source-code review, exploit development, or adversary emulation