Senior Penetration Testing Specialist

Aprio•Atlanta, GA

2d•Hybrid

About The Position

Aprio, a Top 20 CPA-led advisory firm, is seeking an experienced Offensive Security and Penetration Testing professional to join their dynamic Risk Advisory and Assurance Services (RAAS) team. This is a unique opportunity to help develop this service line from the ground up, contributing to cutting-edge initiatives in areas like CMMC, FedRAMP, and PCI SSF. The role involves working on diverse, high-impact projects, with the potential to build a team over time. Aprio offers unparalleled professional development, a collaborative and innovative culture, competitive compensation, comprehensive benefits, and flexible work arrangements. The firm is known for its progressive, fast-growing nature and its commitment to a "Best Place to Work" culture.

Requirements

Minimum of 5 years' experience in penetration testing or a related cybersecurity role, with a focus on network, cloud infrastructure, web application, and API testing.
Expertise in network penetration testing, including assessment of protocols (e.g., TCP/IP, DNS, VPN), firewalls, and intrusion detection/prevention systems.
Hands-on experience with cloud security testing in platforms such as AWS, Azure, or GCP, and their cloud native solutions.
In-depth knowledge of web application penetration testing, covering OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS, CSRF) and secure coding practices.
Strong proficiency in API security testing, including REST, SOAP, and GraphQL, with experience in identifying issues like broken authentication, excessive data exposure, and injection flaws.
Familiarity with common penetration testing tools such as Burp Suite, Metasploit, Nmap, Nessus, Wireshark, and Kali Linux.
Experience with scripting languages (e.g., Python, Bash, PowerShell) for automating tests or developing custom exploits.
Understanding of secure development lifecycle (SDLC) and DevSecOps practices.
Strong analytical and problem-solving skills, with the ability to think like an attacker and identify complex attack chains.
Excellent communication skills to articulate technical findings to both technical and non-technical stakeholders in verbal and written form.

Nice To Haves

Experience with Red-Team and Purple-Team engagements is a huge plus.
OSCP, OSWE, CRTP, and other certifications that require hands on skills application to obtain are a huge plus.

Responsibilities

Help clients maximize their opportunities.
Develop this service line from the ground up.
Contribute to cutting-edge initiatives as we expand into CMMC, FedRAMP, PCI SSF.
Work around other high performers developing custom software security solutions, offering opportunities to tackle unique security challenges in high-stakes, regulated industries.
Work on diverse, high-impact projects across a number of teams and industries.
Take on the opportunity to build a team around you over time.
Conduct cloud infrastructure offensive security assessments (e.g., AWS, Azure, GCP).
Perform web application and API penetration testing.
Conduct traditional network penetration testing.
Develop assessment documentation and document the results of your work.
Integrate security into CI/CD pipelines.

Benefits

Medical, Dental, and Vision Insurance on the first day of employment
Flexible Spending Account and Dependent Care Account
401k with Profit Sharing
9+ holidays and discretionary time off structure
Parental Leave – coverage for both primary and secondary caregivers
Tuition Assistance Program and CPA support program with cash incentive upon completion
Discretionary incentive compensation based on firm, group and individual performance
Incentive compensation related to origination of new client sales
Top rated wellness program
Flexible working environment including remote and hybrid options