Penetration Tester

Promaynov Advisory Services Pvt. Ltd; Bengaluru; On-site; INR 1,400,000 - 2,000,000; Full time

Job summary

Promaynov Advisory Services Pvt. Ltd seeks a seasoned Penetration Tester to independently perform security assessments across web applications, APIs, and mobile platforms in Bengaluru. You will document actionable findings with PoCs and translate technical risks into business impact.

The role requires 4+ years of hands-on testing, deep knowledge of OWASP Top 10, and strong report writing. Mentoring juniors and engaging in client calls are key facets of the position.

Qualifications

• 4+ years hands-on penetration testing or offensive security experience.
• Experience testing at least two of: web apps, APIs, thick client, mainframe, mobile apps.
• Strong knowledge of OWASP Top 10 and common network attack vectors.
• Proficiency with Burp Suite, Nmap, Metasploit.
• Ability to write clear, professional reports independently.

Responsibilities

• Independently perform penetration tests across web apps, APIs, thick client, mainframe, and mobile following established methodologies.
• Identify, exploit, and document vulnerabilities with proof-of-concept evidence.
• Write client-ready findings reports with root-cause analysis and remediation guidance.
• Participate in client-facing calls, scoping, and findings walkthroughs.
• Validate automated scanner outputs and eliminate false positives.
• Mentor junior testers and contribute to internal tooling and methodology.

Skills

Penetration testing

Web applications

APIs

Thick client

Mainframe

Mobile applications

OWASP Top 10

Active Directory attack paths

Communication

Report writing

Client-facing

Tooling

CTFs/bug bounty

Education

OSCP

GPEN

GWAPT

Tools

Burp Suite

Nmap

Metasploit

Job description

Responsibilities

• Independently perform penetration tests across web applications, APIs, thick client, mainframe, mobile following established methodologies (OWASP Testing Guide, PTES, NIST SP 800-115).
• Identify, exploit, and document vulnerabilities, providing clear evidence of impact (proof-of-concept, not just tool output) for each finding.
• Write clear, client-ready findings reports that translate technical vulnerabilities into business risk, including root cause analysis and actionable remediation guidance.
• Participate in client-facing calls, including scoping discussions, kickoff meetings, and findings walkthroughs/readouts.
• Validate automated scanner output to eliminate false positives and confirm real-world exploitability before reporting.
• Collaborate with engagement leads on scoping, methodology selection, and complex or ambiguous findings.
• Stay current on emerging attack techniques, CVEs, and tooling relevant to the engagements you support.
• Mentor junior testers on technique, tooling, and report writing as the team scales.
• Adhere strictly to engagement rules of engagement (RoE), scope boundaries, and legal/ethical testing guidelines on every client engagement.
• Contribute to internal methodology development, tooling improvements, and knowledge-sharing within the practice.

Requirements

• 4+ years of hands-on penetration testing or offensive security experience (internal team or consulting).
• Demonstrated experience testing at least two of the following: web applications, APIs, thick client, mainframe, mobile applications.
• Strong working knowledge of the OWASP Top 10, common network attack vectors, and Active Directory attack paths.
• Proficiency with core tooling: Burp Suite (or equivalent), Nmap, Metasploit,
• Demonstrated ability to write clear, professional findings reports independently — this role requires strong written communication, not just technical execution.
• Comfortable presenting technical findings to both technical and non-technical client stakeholders.
• Industry certifications such as OSCP, GPEN, GWAPT, or equivalent hands-on-proctored certifications (preferred over purely multiple-choice credentials for this role).
• Prior consulting/client-facing experience, including scoping conversations and managing client expectations under time-boxed engagements.
• Experience contributing to or building internal tooling/scripts to improve testing efficiency.
• Active participation in the security community (CTFs, bug bounty, conference talks, published research) as a signal of ongoing skill development