Penetration Tester

Taylor Corporation•North Mankato, MN

10d•$97,000 - $120,000•Onsite

About The Position

Taylor Corporation is seeking a Penetration Tester to perform penetration tests and vulnerability assessments across network, application, cloud, and wireless environments, including segmentation testing, in accordance with industry standards and regulatory requirements. The Penetration Tester will design and perform penetration tests, analyze findings, report results, and consult on remediation options. This mid-level position requires demonstrated hands-on experience with Windows and Linux operating systems, networking, cloud environments, risk management, and secure application development practices, along with the ability to communicate security risk and recommend practical remediation approaches. This position must be performed within the United States. Candidates must be U.S. citizens and able to satisfy applicable customer access, background-screening, and security clearance requirements.

Requirements

A current, industry-recognized penetration testing certification is required at the time of hire (for example, OSCP, PNPT, GPEN, GWAPT, eWPT, or a comparable certification).
Minimum of three years of hands-on experience performing penetration tests in enterprise environments.
A minimum of three years of related experience in information technology, application development, system administration, or a comparable technical discipline; this experience may overlap with the penetration testing experience above.
Experience with common penetration testing and vulnerability assessment tools, including Nmap, Burp Suite Professional, HCL AppScan, Nessus, Metasploit, Kali Linux tools, or comparable technologies.
Hands-on experience with Windows, Linux, Active Directory, cloud platforms, and scripting using Python, PowerShell, Bash, or comparable languages.
Working knowledge of TCP/IP, DNS, routing, firewalls, network segmentation, HTTP/S, authentication, session management, and APIs.
Knowledge of common vulnerability classes, attack paths, defensive controls, and secure software development principles.
Strong collaborative approach and ability to work effectively within cross-functional and remote teams.
Ability to work in a fast-paced, fluid environment.
Self-directed, decisive, and action-oriented.
Ability to work well under minimal supervision and meet deadlines.
Commitment to complete, accurate, and timely documentation and detailed tracking.
Strong written and verbal communication skills.
Ability to clearly and concisely present or document technical issues in a way that nontechnical audiences can understand.
Ability to maintain a broad perspective while managing multiple efforts concurrently.
Strong analytical and problem-solving skills.
Ability to balance competing priorities across security, IT, and the business.
Ability to clearly communicate security risk, respectfully challenge assumptions when appropriate, and support documented management risk decisions.
Ability to interface effectively with a broad range of people and roles, including vendors, customers, IT, and business personnel.
Demonstrated integrity and strong business ethics.
U.S. citizens and able to satisfy applicable customer access, background-screening, and security clearance requirements.

Nice To Haves

Experience applying recognized penetration testing methodologies and secure development principles is highly desirable.
Experience in networking, system administration, scripting, on-premises environments, and cloud environments is desirable.

Responsibilities

Work with business and technical stakeholders to determine test objectives, scope, and rules of engagement.
Design and perform internal and external network, web application, API, cloud, wireless, and segmentation penetration tests and vulnerability assessments against applicable industry standards, regulatory requirements, and contractual obligations.
Perform manual validation and controlled exploitation to confirm vulnerabilities, identify attack paths, and distinguish penetration testing from automated vulnerability scanning.
Develop test plans; conduct reconnaissance, manual testing, and safe exploit validation; protect test data; remove testing artifacts; communicate results; and perform remediation validation and retesting.
Conduct testing using recognized methodologies and requirements, including the OWASP Web Security Testing Guide, OWASP ASVS when applicable, NIST SP 800-115, PTES or a comparable methodology, PCI DSS, and applicable customer or contractual requirements.
Follow approved rules of engagement, test windows, escalation procedures, data-handling requirements, and stop-testing conditions. Coordinate potentially disruptive activity with system owners and immediately report unintended impacts or exposure of sensitive information.
Provide remediation consultation for penetration test findings.
Perform risk assessments of networks and applications, wireless technologies, and other technical environments.
Document results and recommendations using company-standard templates and prepare both detailed technical reports and concise executive summaries.
Develop, document, and maintain penetration test procedures, finding templates, and other documentation.
Review and provide input on penetration test reports prepared by other penetration testers.
Report to management concerning residual risk, vulnerabilities, and other security exposures, including misuse of information assets and noncompliance.
Safeguard credentials, test data, customer information, and exploit evidence; follow responsible disclosure and company ethics requirements; and use testing techniques only within expressly authorized scope.
Remain current on security trends, best practices, and issues.
Perform other duties as assigned.