Penetration Tester

About the Role

The Penetration Tester works to execute offensive security activities for Pathfynder by A-LIGN. In this role, you will be responsible for the delivery of external network, web application, and API penetration testing engagements. As the Penetration Tester, you will provide exceptional technical and client-focused testing strategies to help support the continued growth of our fast-paced company. A-LIGN will depend on you as the Penetration Tester to independently identify and validate real-world security risks, manually exploit vulnerabilities, document findings, and communicate practical remediation guidance to clients.

Reports to

Director, Web Application & External Offensive Operations

Pay Classification

Full-Time, Exempt

Responsibilities

Execute external network, web application, and API penetration testing engagements

Identify, validate, and manually exploit vulnerabilities using public exploits, custom-developed exploits, or a combination of techniques

Evaluate findings in context, develop realistic attack paths, and accurately assess business and technical risk

Deliver clear, accurate, client-ready reports that explain findings, risk ratings, evidence, and actionable remediation guidance

Communicate technical issues, testing results, and remediation recommendations to client stakeholders

Maintain project quality and timelines while executing assigned engagements with minimal oversight

Collaborate with the offensive security team to evaluate tools, improve delivery methods, and share technical knowledge

Mentor junior testers and contribute to the development of team capabilities and repeatable testing practices

Minimum Qualifications

EDUCATION

Degree in in cybersecurity, computer science, a related discipline, or equivalent professional experience

EXPERIENCE

5+ years of hands-on offensive security experience, including at least 3 years focused on external network, web application, or API penetration testing

Experience performing web application penetration testing using black-box, grey-box, and white-box approaches

Experience testing APIs, including REST, GraphQL, SOAP, or gRPC

Proven ability to manage engagements from scoping and execution through reporting and client debriefs.

Working knowledge of OWASP WSTG, OWASP ASVS, OWASP API Security Top 10, and PTES

Consulting or client-facing security delivery experience is preferred

Mobile application penetration testing experience across iOS or Android is preferred

White-box or source-code-assisted testing experience is preferred

CERTIFICATIONS

Required at least one of the following: OSCP/OSCP+, OSWA, eWPT, HTB CWES, TCM PWPP, GWAPT, GPEN, or CREST CRT

Preferred: OSWE, HTB CWEE, BSCP, eWPTX, CREST CCT APP, TCM PWPE, OSEP, or GXPN

Published CVEs, conference presentations, or meaningful contributions to open-source security tooling may be considered in place of certifications

SKILLS

Advanced manual testing skills, including the ability to chain lower-severity findings into high-impact attack paths

Advanced web exploitation knowledge, including access control and authorisation flaws, OAuth, SAML and JWT abuse, SSRF, deserialisation, request smuggling, race conditions, and business logic abuse

Knowledge of external attack surfaces, including OSINT, asset discovery, edge-device exploitation, and SSO or MFA attack techniques

Proficiency with scripting languages such as Python, Bash, JavaScript, PowerShell, or Go, including the ability to build custom tooling and exploits

Proficiency with offensive security and assessment tools such as Burp Suite, Caido, Nmap, Nuclei, SQLmap, ffuf, Postman, and Nessus

Familiarity with common application frameworks, including Laravel, Express.js, ASP.NET Core, Spring, and Django

Ability to write clear, concise, client-ready reports with accurate risk ratings and actionable remediation guidance

Excellent verbal and written communication skills, with the ability to explain technical risks to technical and non-technical audiences

Ability to work independently and collaboratively in a fast-paced, remote environment while meeting deadlines.

Experience assessing AI or LLM-integrated applications for prompt injection, jailbreaks, data leakage, and agent or tool abuse is preferred

Familiarity with the OWASP Top 10 for LLM Applications and cloud attack surfaces across AWS, Azure, or GCP is preferred

Benefits

Healthcare, Dental, and Vision Benefits

Employer Paid Life Insurance and Disability Insurance

EAP - Employee Assistance Program

Pet Insurance

401(k) Plan with Employer Matching

Competitive Bonus Structure

Technology Allowance

Certification Reimbursement

Personalized Career Coaching

Generous Paid Time Off

Paid Office Closure December 25-January 1

Vacation Bonus

Summer Hours

About Pathfynder by A-LIGN

Pathfynder by A-LIGN is a technology-enabled cybersecurity company providing offensive and defensive cybersecurity services under A-LIGN, a security and compliance partner trusted by more than 2,400 global organisations to help mitigate cybersecurity risks. We work with organisations ranging from small businesses to global enterprises, with services spanning SOC, Penetration Testing, PCI DSS, HITRUST, ISO, and privacy compliance. Our proprietary compliance management platform is transforming the compliance experience by enabling an anytime, anywhere approach to audits. To learn more, visit A-LIGN.com.

Come Work for A-LIGN!

Apply online today at A-LIGN.com and learn about life at A-LIGN by following us on LinkedIn.

A-LIGN is an Equal Opportunity Employer. Minorities, women, disabled individuals, and veterans are encouraged to apply.