渗透测试
Penetration Testing
渗透测试员（中级-高级）
地点 - 远程 - 印度
经验水平 - 2-5年
作为渗透测试员，你将负责在客户交付过程中独立执行渗透测试项目，仅需少量监督。你将独立完成测试活动，识别并利用漏洞，并提供高质量的客户交付成果，包含清晰、可操作的修复建议。你将使用自动化工具和手动技术对网页应用、API、网络和/或云环境进行评估。这包括配置和操作测试工具，开发演示影响的POC，并清晰记录发现。你还将参与客户面对面的活动，如范围讨论、启动会议和报告评审，并能够向技术和非技术受众有效传达技术概念。除了交付工作外，你还将通过执行质量保证、重新测试、同行评审、支持内部工具和方法改进以及与其他团队成员分享知识，为测试项目的整体质量和演进做出贡献。
必备条件：进攻性安全认证，具有测试网页应用和API（REST、SOAP、XML、JSON）及胖客户端的经验
主要职责：
· 在网页应用、API、网络和云环境中执行渗透测试项目
- 识别、利用并记录带有明确支持证据和POC的漏洞
- 开发实际的、基于风险的修复建议
- 生成高质量的、客户可用的报告
- 参与客户面对面的会议，包括范围确定、启动会议和报告评审
- 对同行交付成果进行质量保证评审
- 为内部工具、研究和方法改进做出贡献
- 支持和协作团队成员以保持交付质量和一致性
- 以保密和专业的方式处理敏感的客户信息
资格与经验：
- 对网络、网页/移动应用和常见安全漏洞（例如OWASP Top 10、常见CVE）有深入理解
- 行业相关的认证（SANS、进攻性安全、eLearn Security等）
- 具有测试网页应用和API（REST、SOAP、XML、JSON）的经验
- 熟悉现代网页框架（例如Angular、Bootstrap）
- 具有脚本语言（如Python、Bash、PowerShell或类似）的经验
- 了解漏洞
查看英文原文
Penetration Tester (Mid–Senior Level)
Location - Remote - India
Experience Level - 2-5 years
As a Penetration Tester, you will be responsible for executing penetration testing engagements through client delivery with minimal oversight. You will independently perform testing activities, identify and exploit vulnerabilities, and produce high-quality client deliverables with clear, actionable remediation guidance.You will assess web applications, APIs, networks, and/or cloud environments using a combination of automated tools and manual techniques. This includes configuring and operating testing tools, developing proof-of-concepts to demonstrate impact, and clearly documenting findings.You will also participate in client-facing activities such as scoping discussions, kickoff calls, and report reviews, and are expected to communicate technical concepts effectively to both technical and non-technical audiences. In addition to delivery, you will contribute to the overall quality and evolution of the testing program by performing QA, Re-Tests, peer reviews, supporting internal tooling and methodology improvements, and sharing knowledge with other team members.
Must Have: Offensive Security CertificationExperience testing web applications and APIs (REST, SOAP, XML, JSON) and thick client
Key Responsibilities:
· Execute penetration testing engagements, across web applications, APIs, networks, and cloud environments
- Identify, exploit, and document vulnerabilities with clear supporting evidence and proof-of-concept
- Develop practical, risk-based remediation guidance
- Produce high-quality, client-ready reports
- Participate in client-facing calls including scoping, kickoff, and report reviews
- Perform QA reviews of peer deliverables
- Contribute to internal tools, research, and methodology improvements
- Support and collaborate with team members to maintain delivery quality and consistency
- Handle sensitive client information with confidentiality and professionalism
Qualifications & Experience:
- Strong understanding of networks, web/mobile applications, and common security vulnerabilities (e.g., OWASP Top 10, common CVEs)
- Industry-relevant certifications (SANS, Offensive Security, eLearn Security, etc.)
- Experience testing web applications and APIs (REST, SOAP, XML, JSON)
- Familiarity with modern web frameworks (e.g., Angular, Bootstrap)
- Experience with scripting languages such as Python, Bash, PowerShell, or similar
- Knowledge of vulnerabilities including XSS, SQL Injection, XXE, SSRF, deserialization, file inclusion/path traversal, authentication flaws, and remote code execution
- Ability to develop proof-of-concepts and clearly demonstrate impact
- Strong written and verbal communication skills
- Ability to work independently and as part of a team
Originally posted on Himalayas