Penetration Tester

OSec•New York, NY

About The Position

The Penetration Tester works as part of OccamSec’s Assessment Team to conduct and participate in offensive and defensive security projects for the company and its clients. The role reports to an Assessment Team Lead. The tester performs security assessments and penetration tests, documents findings and assessment evidence, and advises clients on reducing security risks. Work may be performed collaboratively on complex projects with senior-team oversight or independently within the tester’s defined skill set, with Project Manager oversight.

Requirements

At least 2–3 years of professional experience is preferred.
Proficiency working with AWS services such as EC2, S3, KMS, and RDS, or similar Azure and GCP services, with a focus on security best practices.
Skill conducting penetration tests for APIs, mobile applications, cloud environments, and web applications.
Familiarity with scripting languages such as Python, Perl, Go, or Ruby.
Hands-on experience building or developing server or application technologies.
Experience using penetration-testing tools effectively in various scenarios.
Experience replicating threat behaviors.
Proficiency using packet analyzer tools such as Wireshark and tcpdump.
Sound understanding of IP network protocols, subnetting, routing, and switching.
Extensive experience penetrating and exploiting secure networks and systems, and staying current with security software packages, protocols, and computer technologies.
Excellent written and oral communication skills, with a proven track record of producing comprehensive reports and assessments.

Responsibilities

Conduct security audits, network penetration tests, and web application, API, and cloud assessments.
Draft security assessment reports outlining findings and provide an evidence-supported walkthrough of the assessment performed.
Use social engineering to identify opportunities to improve security awareness and education.
Provide clients with guidance and recommendations for fixing or reducing security risks to their networks and products.
Work as part of a team on larger, more complex projects with oversight from senior team members.
Operate independently on projects within the defined skill set, with oversight from a Project Manager.
Maintain proficiency in current security tools and skills.