Penetration Tester

ThoughtLabs Belgium; Strasbourg; On-site; EUR 70,000 - 100,000; Full time

Job summary

ThoughtLabs Belgium is seeking an experienced penetration tester to identify and assess vulnerabilities across applications and infrastructure. You will perform SAST/DAST, code review, and vulnerability testing, document results, and advise on remediation. The role requires hands-on testing of web, mobile, and thick-client environments and a strong security mindset.

Qualifications

• University degree in IT with relevant experience in IT security services.
• At least 7 years providing IT/security consulting and advisory services.
• Experience with SAST and DAST tools and vulnerability testing.

Responsibilities

• Identify and assess cybersecurity vulnerabilities across systems and processes.
• Demonstrate exploitation of technical vulnerabilities and attack vectors.
• Test systems for regulatory compliance and security standards.
• Develop penetration testing techniques and test plans.
• Document, analyze and report results to stakeholders.

Skills

Penetration testing

Secure code review

CI/CD security

Education

University degree in IT

Tools

SonarQube

OWASP

FortifySCA

OWASP ZAP

Burp Suite

Kali Linux

GitHub Advanced Security

JFrog XRay

JFrog Curation

Advanced Cluster Security

Job description

• Identify, analyse and assess technical and organisational cybersecurity vulnerabilities;
• Identify attack vectors, uncover and demonstrate exploitation of technical cybersecurity vulnerabilities;
• Test systems and operations compliance with regulatory standards;
• Select and develop appropriate penetration testing techniques;
• Organise test plans and procedures for penetration testing;
• Establish procedures for penetration testing result analysis and reporting;
• Document and report penetration testing results to stakeholders;
• Deploy penetration testing tools and test programs;
• Security source code review or development experience at least in C/C++, C#, VB.NET, ASP, or Java;
• Identify the security risk level, business impact and provide the remediation plan;
• Use tools and manual testing to perform code security analysts to identify vulnerabilities and attack vectors in applications and infrastructure. Execute SAST, DAST, vulnerability scans and penetration tests;
• Draft security test cases based on the requirements.

Requirements

• University degree in IT combined with relevant professional experience of at least 7 years in providing IT and Information security services;
• Experience with penetration testing against a wide variety of applications including web, mobile, and thick client above and beyond running automated tools required;
• Experience providing consulting services in a highly confidential environment;
• Experience with SAST: SonarQube, OWASP, FortifySCA, NVD;
• Experience with DAST, Web Application and Penetration Tests: Fortify WebInspect, OWASP ZAP, Burp Suite, Kali Linux;
• Experience with dependencies and containers tests: GitHub Advanced Security, JFrog XRay, JFrog Curation, Advanced Cluster Security;
• Experience in technical analysis, reporting and writing documents;
• Experience in decomposing and analysing systems to identify weaknesses and ineffective controls;
• Experience in reviewing codes assess their security;
• Industry certifications or similar qualifications appropriate to the services provided, such those listed below, will be considered a plus: GIAC Certified Penetration Tester (GPEN), GIAC Web Application Penetration Tester (GWAPT), Certified Ethical Hacker (CEH), GIAC Systems and Network Auditor (GSNA), Certified Penetration Tester (CPT), Certified Expert Penetration Tester (CEPT), GIAC Certified Web Application Defender (GWEB), ISC2 Certified Secure Software Lifecycle Professional (CSSLP), Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), CREST Penetration Testing Certifications.
• Excellent command of the English language.