Penetration Tester - Hybrid - BGC - up to 100K

weSource Management Consultancy Firm; Taguig; Hybrid; PHP 892,800 - 1,116,000; Full time

Job summary

A management consultancy firm in Taguig is looking for a Penetration Tester to assess web applications and infrastructure, identifying vulnerabilities and providing solutions. The successful candidate will have a strong understanding of security methodologies and will work closely with a multidisciplinary team in a hybrid environment. Key competencies include vulnerability assessments, penetration testing, and familiarity with industry certifications such as CEH or OSCP. This role offers competitive compensation potentially up to 100K.

Qualifications

• In-depth knowledge of web application vulnerabilities and mitigation strategies.
• Working knowledge of on-prem and cloud builds (IaaS, PaaS, SaaS).
• Proficiency in various penetration testing methodologies and tools.
• Strong problem-solving skills to understand attack vectors.

Responsibilities

• Conduct comprehensive assessments of web applications and infrastructure.
• Perform controlled attacks on web applications and APIs.
• Analyze results of penetration tests to assess vulnerabilities.
• Prepare detailed reports documenting findings and recommendations.
• Collaborate with developers for fixing identified vulnerabilities.
• Stay updated on latest vulnerabilities and attack techniques.
• Conduct testing within a legal and ethical framework.
• Engage in professional development activities to enhance skills.

Skills

Web Application Security

Infrastructure security

Penetration Testing Techniques

Analytical and Problem-Solving Skills

Education

Bachelor's degree in computer science, information security, or cybersecurity

Tools

OWASP Top 10 vulnerability knowledge

Automated vulnerability scanners

Exploit frameworks

Job description

Penetration Tester - Hybrid - BGC - up to 100K

About the job Penetration Tester - Hybrid - BGC - up to 100K

The Role

A penetration tester is responsible for assessing the security of web applications and its underlying infrastructure to identify vulnerabilities and weaknesses that could be exploited by attackers. Their role involves conducting thorough assessments and penetration tests to uncover potential security risks and provide recommendations for mitigation.

The role will work closely alongside the rest of the Penetration Testing team, Business units and other Cyber team.

We are looking for a collaborative team player, with a good technical knowledge in web application and infrastructure penetration testing. The successful candidate will contribute to and work as part of a global multi-disciplined security community with clear vision and direction, and top-down support across the business.

Responsibility:

• Vulnerability Assessment: Conducting comprehensive assessments of web applications and Infrastructure to identify security vulnerabilities, such as cross-site scripting (XSS), SQL injection, authentication flaws, insecure configurations, poor host device and service configurations, and use these to penetrate deeper into the application/server.
• Penetration Testing: Performing controlled attacks on web applications. APIs, infrastructure, and simulate real-world hacking attempts and identify potential entry points for attackers. This involves utilizing various techniques, tools, and methodologies to exploit vulnerabilities and gain access.
• Security Analysis: Analyzing the results of penetration tests to assess the severity of identified vulnerabilities, their potential impact on the system and the business, and the likelihood of exploitation.
• Reporting and Documentation: Preparing detailed reports that document the findings, including identified vulnerabilities, attack vectors, and recommendations for remediation. These reports typically outline the risks associated with each vulnerability and provide guidance on how to mitigate them.
• Remediation Support: Collaborating with developers and system administrators to assist in the remediation of identified vulnerabilities. This may involve providing guidance on secure coding practices, recommending security controls, or validating the effectiveness of implemented fixes.
• Stay Up to Date: Keeping abreast of the latest web application and infrastructure vulnerabilities, attack techniques, security tools, and industry best practices. This includes staying informed about emerging threats and trends in web applications and infrastructure.
• Ethical Approach: Conducting all testing and assessment activities within a legal and ethical framework, ensuring that the organizations systems and data are not compromised or harmed during the process.
• Continuous Improvement: Engaging in professional development activities, such as attending conferences, participating in training programs, and obtaining relevant certifications, to enhance knowledge and skills in cyber security.

The Requirements

• Education: A bachelors degree in a related field such as computer science, information security, or cybersecurity is commonly preferred, but not always mandatory. Relevant industry experience can compensate for formal education requirements.
• Skills:
  • Web Application Security: In-depth knowledge of web application vulnerabilities, common attack techniques, and mitigation strategies. Strong understanding of OWASP Top 10 vulnerabilities is crucial.
  • Infrastructure security: Working knowledge of different on-prem and cloud builds (IaaS, PaaS, SaaS), in-depth understanding of operating system and its common flaws.
  • Penetration Testing Techniques: Proficiency in various penetration testing methodologies, tools, and frameworks. Experience with manual testing techniques, automated vulnerability scanners, and exploit frameworks is necessary.
  • Analytical and Problem-Solving Skills: Ability to analyze complex web application environments, identify vulnerabilities, and exploit them. Strong problem-solving skills to understand attack vectors and recommend appropriate countermeasures.
  • Holds relevant industry certification/s or equivalent like the following:
    • CEH Certified Ethical Hacker
    • OSCP Offensive Security Certified Professional
    • PNPT Practical Network Penetration Tester
• Practical experience gained through participation in bug bounty programs, capture-the-flag (CTF) competitions, and real-world projects can also be valuable in showcasing skills and expertise.