Penetration Tester

OSec•New York, NY

About The Position

The Penetration Tester works as part of OccamSec’s Assessment Team to conduct and participate in offensive and defensive security projects for the company and its clients. The role reports to an Assessment Team Lead. The position conducts security audits and penetration tests and assessments across networks, web applications, APIs, mobile applications, and cloud environments. It also produces detailed reports documenting findings, assessment methods, and supporting evidence, and advises clients on how to remediate or reduce security risks. The tester may work on complex projects alongside senior team members or independently on projects within their defined skill set, with oversight from a Project Manager. The role requires maintaining proficiency in current security tools and skills.

Requirements

At least 2–3 years of professional experience is preferred.
Proficiency with AWS services such as EC2, S3, KMS, and RDS, or similar services on Azure or GCP, with a focus on implementing security best practices.
Skill conducting penetration tests for APIs, mobile applications, cloud environments, and web applications.
Familiarity with scripting languages such as Python, Perl, Go, or Ruby.
Hands-on experience building or developing server or application technologies.
Experience using penetration testing tools effectively in various scenarios.
Experience replicating threat behaviors.
Proficiency with packet analyzer tools such as Wireshark and tcpdump.
Sound understanding of IP network protocols, subnetting, routing, and switching.
Extensive background penetrating and exploiting secure networks and systems, and staying current with security software packages, protocols, and computer technologies.
Excellent written and oral communication skills, with a proven track record of producing comprehensive reports and assessments.

Responsibilities

Conduct security audits, network penetration tests, and web application, API, and cloud assessments.
Draft security assessment reports outlining findings, documenting the assessment performed, and providing appropriate evidence.
Use social engineering to identify opportunities to improve security awareness and education.
Guide clients and recommend ways to fix or reduce security risks to their networks and products.
Work as part of a team on larger, more complex projects with oversight from senior team members.
Operate independently on projects within the defined skill set, with oversight from a Project Manager.
Maintain proficiency in current security tools and skills.