Mid-Level Offensive Security Analyst – Pentest, Red Team

Jobtailor; São Paulo; Presencial; BRL 120 000 - 180 000; Tempo integral

Resumo da oferta

Jobtailor is seeking an experienced security tester in São Paulo to perform manual and hybrid penetration tests on web apps, APIs, and mobile apps. You will validate findings with PoCs, classify risks, and recommend practical mitigations while collaborating with DevSecOps and Infra teams.

The role requires hands-on testing throughout internal and external networks, cloud exposures, and insecure configurations.

Qualificações

• Hands-on experience with web/API pentesting and OWASP Top 10 knowledge.
• Knowledge of authentication/authorization mechanisms and CORS.
• Experience with automation scripting in Python or JavaScript.

Responsabilidades

• Perform manual and hybrid penetration tests on web apps, APIs, and mobile apps.
• Validate vulnerabilities with PoCs, classify risks, and suggest mitigations.
• Test internal/external networks, cloud exposures, and insecure configurations.
• Support Red Team exercises, evidence collection, and attack-path documentation.
• Produce comprehensive reports with reproducible steps and retest results.
• Present findings to Dev, AppSec, and Infra teams.
• Maintain testing playbooks, checklists, and payload repos.
• Assist simple automation to scale evidence collection.

Conhecimentos

Web Penetration Testing

API Penetration Testing

Scripting

Authentication/Authorization

Cloud & Containers familiarity

Threat modelling

Communication

Ferramentas

Burp Suite

Postman

Nmap

Nuclei

Nikto

Sqlmap

Docker

Kubernetes

Descrição da oferta de emprego

• Perform manual and hybrid penetration tests on web applications, REST/GraphQL APIs, and Android/iOS mobile apps


• Validate and reproduce vulnerabilities through proof of concept (PoC), classify risks, and recommend practical mitigations


• Conduct tests of internal/external network infrastructure, cloud exposures, and insecure configurations


• Support controlled Red Team exercises, evidence collection, and documentation of the attack path


• Prepare comprehensive technical reports with reproducible steps, impact, evidence, and retest results


• Present findings to Dev, AppSec, and Infrastructure teams


• Maintain and improve testing playbooks, checklists, and payload repositories


• Support simple automation using scripts to increase scale and standardize evidence collection

Requirements

• Hands-on experience with web and API penetration testing, with strong knowledge of the OWASP Top 10 and OWASP API Top 10


• Experience with Burp Suite, Postman/Insomnia, Nmap, Nuclei, Nikto, sqlmap, fuzzing tools, and supporting scanners


• Solid understanding of authentication/authorization (OAuth2/OIDC, JWT, SSO), sessions, CORS, rate limiting, and access controls


• Scripting for automation: Python and/or JavaScript (Node.js), plus Bash fundamentals


• Familiarity with containers (Docker), Kubernetes concepts, CI/CD, and cloud platforms (Azure/AWS/GCP)


• Familiarity with logic and authorization testing, such as BOLA/BFLA


• Certifications such as eJPT, eCPPT, PNPT, Security+, CEH, and eWPT, as well as OWASP training, are desirable and considered a plus


• Strong sense of ownership, autonomy, organization, and accountability for evidence


• Clear and concise communication skills to translate technical findings into actionable steps for Dev/Infrastructure teams


• Curiosity, an investigative mindset, and discipline in documenting and retesting


• Collaboration, technical humility, fast learning, and openness to feedback

Core Competencies

Demonstrates expertise in manual and hybrid penetration testing of web applications, APIs, and mobile apps, with a strong focus on vulnerability validation and risk classification. Proficient in scripting for automation and familiar with cloud platforms and containerization concepts.

Highest-signal resume keywords

• Web Penetration Testing


• API Penetration Testing


• Burp Suite


• Python Scripting


• OWASP Top 10

Hard Skills

• Penetration Testing


• Vulnerability Assessment


• Risk Classification


• Scripting


• Authentication/Authorization


• Logic Testing


• Cloud Exposure Testing


• Network Infrastructure Testing


• Technical Reporting


• Evidence Collection

Soft Skills

• Clear Communication


• Curiosity


• Investigative Mindset


• Collaboration


• Accountability

Certifications & Qualifications

• EJPT


• ECPPT


• PNPT


• Security+


• CEH


• EWPT

Industry Keywords

• OWASP


• Red Team Exercises


• CORS


• Rate Limiting


• Access Controls

Tools & Technologies

• Burp Suite


• Postman


• Nmap


• Nuclei


• Nikto


• Sqlmap


• Docker


• Kubernetes


• CI/CD


• Azure