Penetration Tester (AI-Enabled)

Hudson Manpower•Chaska, MN

7d•Onsite

About The Position

The Penetration Tester uses AI and generative AI to accelerate security testing activities, including reconnaissance, test-case generation, analysis, scripting, and reporting. The role conducts penetration tests and vulnerability assessments across web applications, APIs, networks, cloud environments, mobile applications, and other systems. It identifies, validates, documents, and assesses vulnerabilities, performs controlled exploitation to evaluate their impact and risk, and provides actionable remediation recommendations in detailed assessment reports. The position collaborates with development and infrastructure teams to resolve security issues, reviews security practices for compliance with organizational and industry standards, and supports secure software development and application security best practices. It also assesses risks in AI and LLM applications, including prompt injection, sensitive information exposure, insecure interactions, and excessive agency, and evaluates attack surfaces involving models, data, applications, APIs, RAG pipelines, and AI agents. The position is onsite in Chaska, Minnesota, and is a contract role for 12+ months.

Requirements

At least 3 years of experience in penetration testing and vulnerability assessments.
Experience testing web applications, APIs, networks, and cloud environments.
Hands-on experience with industry-standard security testing tools and exploit frameworks.
Ability to identify, validate, document, and remediate security vulnerabilities.
Knowledge of secure coding practices and application security concepts.
Experience preparing security assessment reports and presenting findings to stakeholders.
Understanding of cybersecurity threats, attack methodologies, and defense mechanisms.
Ability to assess prompt injection, insecure model/application interactions, sensitive information exposure, excessive agency, and other LLM application risks.
Ability to identify AI attack surfaces across models, data, applications, APIs, RAG pipelines, and AI agents using frameworks such as MITRE ATLAS.
Experience using approved LLM/AI tools for test-case generation, reconnaissance analysis, vulnerability analysis, scripting, and report generation.
Hands-on experience with AI-enabled penetration testing.

Nice To Haves

Certifications such as CEH, OSCP, GPEN, or PNPT are preferred.
Experience with web application penetration testing (OWASP Top 10), API security testing, network penetration testing, vulnerability assessment and management, cloud security testing (AWS, Azure, or GCP), mobile application security testing (Android/iOS), and Active Directory security assessments.
Knowledge of security risk assessment and threat analysis, OWASP, PTES, NIST, ISO 27001, PCI-DSS, and SOC 2.
Experience with Burp Suite Professional, OWASP ZAP, Metasploit, Nessus, Qualys, Nmap, Wireshark, and Kali Linux.
Scripting experience with Python, PowerShell, and Bash/Shell.

Responsibilities

Use AI and generative AI to accelerate penetration-testing activities, including reconnaissance, test-case generation, analysis, scripting, and reporting.
Conduct security testing of web applications, APIs, networks, cloud environments, and other systems.
Identify, validate, and document security vulnerabilities and weaknesses.
Perform controlled exploitation to assess the impact and risk of vulnerabilities.
Execute vulnerability assessments using manual and automated testing tools.
Prepare detailed security assessment reports with actionable remediation recommendations.
Collaborate with development and infrastructure teams to resolve security issues.
Conduct security reviews for compliance with organizational and industry standards.
Support secure software development practices and promote application security best practices.
Assess prompt injection, insecure model/application interactions, sensitive information exposure, excessive agency, and other LLM application risks.
Identify attack surfaces across models, data, applications, APIs, RAG pipelines, and AI agents.