Security Pentester – Web Apps & Active Directory

Pauwels Consulting; Brussel; Sur place; EUR 83 000 - 148 000; Plein temps

Résumé du poste

Pauwels Consulting is seeking a Security Pentester for a major public sector client in Brussels. You will perform web app, API, and network security testing, and craft detailed remediation reports.

Responsibilities include testing Windows/AD environments, contributing to security tooling, and presenting findings to project teams. Fluency in multiple languages and strong technical writing are valued for collaboration with senior experts.

Qualifications

• 3+ years in offensive security focusing on web app and API testing (OWASP).
• 3+ years in network security with TCP/IP, DNS, HTTP/S, and SMB.
• Windows/Active Directory security knowledge: NTLM, Kerberos, PowerShell.

Responsabilités

• Perform penetration tests on web apps, APIs, and portals (black/grey/white box).
• Assess internal/external networks for segmentation, filtering and protocol issues.
• Test Windows/Active Directory environments (Kerberos, GPO, ACL, lateral movement).
• Analyze architectures and data flows to identify attack surfaces and critical assets.
• Document vulnerabilities with reproduction steps and remediation recommendations.
• Present findings to technical teams and project managers for risk management.
• Contribute to internal methodologies, checklists, and tooling improvements.

Connaissances

Offensive security

Web application security

API security

Network security

Windows security

Active Directory security

PowerShell

Technical writing

Multilingual

Outils

Kali Linux

Burp Suite

Nmap

Metasploit

Description du poste

Our client, a major public sector organization, is looking for a Security Pentester to strengthen its offensive security capabilities. The role involves performing penetration tests on web applications, networks, and Windows environments while producing technical reports to facilitate effective remediation.

• Perform penetration tests in black, grey, and white box modes on web applications, APIs, and administration portals.
• Conduct internal and external network infrastructure assessments focusing on segmentation, filtering, and protocol vulnerabilities.
• Execute security tests on Windows and Active Directory environments, including Kerberos, GPO, ACL, and lateral movement analysis.
• Analyze technical architectures and data flows to identify attack surfaces and critical assets.
• Document vulnerabilities and draft technical reports with detailed reproduction steps and remediation recommendations.
• Present findings to technical teams and project managers to assist in risk management.
• Contribute to internal knowledge sharing, including methodologies, check-lists, and tooling improvements.

• You have 3+ years of experience in offensive security with a focus on web application and API testing using OWASP methodologies.
• You bring 3+ years of experience in network security and infrastructure protocols including TCP/IP, DNS, HTTP/S, and SMB.
• You possess practical knowledge of Windows and Active Directory security, specifically regarding NTLM, Kerberos, and PowerShell.
• You're proficient with security tooling such as Kali Linux, Burp Suite, Nmap, and Metasploit.
• You have a solid understanding of modern authentication protocols like OAuth 2.0, OIDC, SAML, and JWT.
• You possess strong technical writing skills and the ability to work collaboratively with senior experts.
• You have active knowledge of French, Dutch, and English.

Nice to Haves

• Certifications such as OSCP, BSCP, or CRTP.
• Experience with cloud environments like Azure, AWS, or GCP.
• Knowledge of containers, Kubernetes, and CI/CD security.
• Experience in mobile application security testing.

• Start date: 1 November 2026
• Duration: 2 months
• Work regime: Full-time
• Location: Brussels
• Working model: Onsite
• Contract: open to both permanent employees and freelancers