Penetration Tester

Centurion Information Security; Hong Kong; On-site; HKD 350,000 - 550,000; Full time

Job summary

Centurion Information Security in Hong Kong seeks a Penetration Tester to identify vulnerabilities in clients’ networks, systems and applications. You will conduct independent testing and deliver actionable reports with risk-based recommendations to strengthen security postures.

You will collaborate with client teams, contribute to internal methodologies, and mentor junior staff while staying ahead of evolving threats and industry best practices.

Qualifications

• Hands-on experience with penetration testing methodologies.
• Ability to document findings clearly for technical and non-technical audiences.
• Knowledge of secure coding practices and threat modeling.

Responsibilities

• Perform independent penetration testing on networks, systems and applications.
• Conduct vulnerability assessments and security consulting for clients.
• Develop detailed reports with findings, risk ratings and remediation recommendations.
• Collaborate with clients to define scope of work and deliverables.

Skills

Penetration testing

Vulnerability assessments

Written and verbal communication

Ethics and confidentiality

Team collaboration

Education

Bachelor's degree in Computer Science / Cyber Security / Information Technology

Tools

Burp Suite Pro

Job description

Job Overview

As a Penetration Tester, you will play a critical role in identifying and assessing vulnerabilities in our Clients' networks, systems, and applications. You will be responsible for conducting independent penetration testing and vulnerability assessments to proactively identify and exploit vulnerabilities in order to assess the security posture and resilience of our Clients' assets. You will work closely with our Clients to provide expert insights and recommendations for improving their security posture and mitigating risks.

Penetration Testing

• Communicate effectively and collaborate with clients to understand their business requirements to provide tailored scope of work (SOW).
• Perform independent penetration testing, source code review, vulnerability assessments and other information security consulting services provided by the Company.
• Develop detailed reports documenting findings and recommendations.

Service Delivery

• Ensure that all your work meets high-quality standards, is delivered timely and reflects the highest level of technical excellence and capabilities in accordance with the Company's standards.
• Aim to achieve and demonstrate the highest level of Client satisfaction and service delivery excellence in all aspects of your work.

Team Collaboration, Professional Conduct & Development

• Act as a team player, providing assistance, sharing knowledge and experience, actively contributing to the success of the team.
• Contribute to the development of the Company's internal methodologies, policies, processes, tools and techniques.
• Provide technical guidance and mentoring to junior team members, as needed.
• Maintain a good professional standing, act with integrity and ethics, and treat colleagues and Clients with respect.
• Actively invest in professional development by staying updated with the latest industry trends, technologies and threat landscapes to continually enhance knowledge and technical skills.

Experience / Skills For Role

• Qualification in Computer Science, Cyber Security, Information Technology or related field.
• Experience in conducting penetration testing and vulnerability assessments in a professional setting.
• Excellent communication skills, both written and verbal, with the ability to effectively communicate technical concepts to non-technical stakeholders.
• Strong ethical mindset, maintaining confidentiality and integrity of client data and information.

Desired Professional Qualifications / Skills

• CREST certifications, Offensive Security Certified Professional (OSCP) or related certifications
• Knowledge and experience with PortSwigger Burp Suite Pro
• Knowledge and experience in evaluating applications against OWASP ASVS and MASVS