Junior Penetration Tester - Web/API/Mobile Security

SQUAD - Cabinet de conseils et d’expertises; España; On-site; PHP 3,762,000 - 5,643,000; Full time

Job summary

SQUAD - Cabinet de conseils et d’expertises is seeking a Junior Pentester to join a hands-on pentest practice focused on web, mobile, and API applications. You will work with senior testers on long-running client missions, conduct hands-on assessments, and document findings clearly to grow into more autonomous engagements.

Responsibilities include testing web apps, APIs, and mobile apps per OWASP guidelines, performing vulnerability discovery, and contributing to internal docs while supporting

Qualifications

• 3 years of cybersecurity experience with at least 1 year in app pentesting.
• Solid knowledge of web vulnerabilities (injection, authN/authZ, SSRF, IDOR).
• Experience with Burp Suite, ZAP, and recon/exploitation tooling.
• Basic scripting (Python or Bash) to support testing.
• Preferred: eJPT, eWPT, OSCP or equivalent hands-on credentials.

Responsibilities

• Pen-test web apps, APIs, and mobile apps following OWASP methods.
• Perform manual and tool-assisted vulnerability discovery.
• Reproduce, validate, and document vulnerabilities with evidence and risk framing.
• Write pentest reports and executive summaries in English.
• Support remediation discussions with development teams.
• Contribute to internal methodology and checklists.
• Work on long-duration client missions with consistent quality.

Skills

Cybersecurity experience

Application pentesting

Burp Suite

OWASP ZAP

Python

Bash

English proficiency

Independent working

Tools

Burp Suite

OWASP ZAP

Job description

SQUAD - Cabinet de conseils et d’expertises is seeking a Junior Pentester to join a hands-on pentest practice focused on web, mobile, and API applications. You will work with senior testers on long-running client missions, conduct hands-on assessments, and document findings clearly to grow into more autonomous engagements.

Responsibilities include testing web apps, APIs, and mobile apps per OWASP guidelines, performing vulnerability discovery, and contributing to internal docs while supporting