Penetration Tester

Remote. Posted 10 months ago

The role

You will conduct continuous manual penetration testing across client attack surfaces including network, web app, cloud, and social engineering. You will use platform-surfaced leads to perform deep exploitation and write business-relevant attack narratives.

What you will do

Own continuous testing across clients' full attack surfaces
Push raw leads into deep, chained, business-level impact
Validate whether activity was detected and acted on
Write clear, business-relevant attack narratives
Run debriefs and client conversations
Feed repeatable techniques and automation candidates back to R&D
Mentor junior testers and interns
Build scripts and tooling to improve efficiency

Required qualifications

Web application testing beyond OWASP Top 10 basics
Network and Active Directory testing
Comfort directing, supervising, and validating AI and automation tooling
Post-exploitation and impact demonstration
Scripting ability (Python, Bash, or equivalent)
Client-facing experience delivering findings
Comfort with ambiguity

Nice to have

OSCP or equivalent hands-on certification
OSWE, CRTO, GPEN, GWAPT, or cloud security certifications (AWS Security Specialty, AZ-500)
Published research, disclosed CVEs, or an active bug bounty profile

Benefits

Unlimited and mandatory PTO
Company matched 401k
75% company contribution for health insurance for employees
50% company contribution for health insurance for dependants
100% company contribution for dental and vision
Flexible working hours
Hardware and tools of your choice
Support for career development with paid training, conferences, certifications, etc.

Before you apply

If OSCP or equivalent isn't already held, we expect it within roughly 12 months

About the company

Sprocket Security prioritizes offensive security for enterprises using an expert-driven Continuous Penetration Testing platform.