Penetration Tester - Up to 100K - Hybrid BGC - Midshift

weSource Management Consultancy Firm; Metro Manila; Hybrid; PHP 90,000 - 110,000; Full time

Job summary

A leading consultancy firm in Metro Manila is seeking a skilled Penetration Tester to conduct security assessments of web applications and infrastructure. The role involves performing vulnerability assessments, penetration testing, security analysis, and collaborating with developers for remediation. Ideal candidates have a bachelor's degree in a related field and strong knowledge of web application security. This hybrid position offers a dynamic working environment and opportunities for professional development.

Qualifications

• In-depth knowledge of web application vulnerabilities, common attack techniques, and mitigation strategies.
• Working knowledge of different on-prem and cloud builds.
• Proficiency in various penetration testing methodologies, tools, and frameworks.

Responsibilities

• Conduct comprehensive assessments of web applications and infrastructure for vulnerabilities.
• Perform controlled attacks on web applications, APIs, and infrastructure.
• Analyze penetration test results for severity and impact.

Skills

Web Application Security

Infrastructure security

Penetration Testing Techniques

Analytical and Problem-Solving Skills

Education

Bachelor's degree in computer science, information security, or cybersecurity

Job description

Penetration Tester - Up to 100K - Hybrid BGC - Midshift

Job Openings Penetration Tester - Up to 100K - Hybrid BGC - Midshift

About the job

The Role A penetration tester is responsible for assessing the security of web applications and their underlying infrastructure to identify vulnerabilities and weaknesses that could be exploited by attackers. Their role involves conducting thorough assessments and penetration tests to uncover potential security risks and provide recommendations for mitigation. The role will work closely alongside the rest of the Penetration Testing team, Business units and other Cyber team. We are looking for a collaborative team player, with a good technical knowledge in web application and infrastructure penetration testing. The successful candidate will contribute to and work as part of a global multi-disciplined security community with clear vision and direction, and top-down support across the business.

Responsibilities

• Vulnerability Assessment: Conduct comprehensive assessments of web applications and infrastructure to identify security vulnerabilities, such as cross-site scripting (XSS), SQL injection, authentication flaws, insecure configurations, poor host device and service configurations, and use these to penetrate deeper into the application/server.
• Penetration Testing: Perform controlled attacks on web applications, APIs, and infrastructure, simulating real-world hacking attempts and identifying potential entry points for attackers using various techniques, tools, and methodologies to exploit vulnerabilities and gain access.
• Security Analysis: Analyze the results of penetration tests to assess the severity of identified vulnerabilities, their potential impact on the system and business, and the likelihood of exploitation.
• Reporting and Documentation: Prepare detailed reports that document the findings, including identified vulnerabilities, attack vectors, and remediation recommendations. Reports typically outline risks and provide guidance on mitigation.
• Remediation Support: Collaborate with developers and system administrators to assist in the remediation of identified vulnerabilities, including guidance on secure coding practices, recommending security controls, or validating the effectiveness of fixes.
• Stay Up to Date: Keep abreast of the latest web application and infrastructure vulnerabilities, attack techniques, security tools, and industry best practices, including emerging threats and trends.
• Ethical Approach: Conduct all testing within a legal and ethical framework, ensuring systems and data are not compromised or harmed during the process.
• Continuous Improvement: Engage in professional development activities to enhance knowledge and skills in cyber security.

Requirements

• Bachelors degree in a related field such as computer science, information security, or cybersecurity is commonly preferred, but not always mandatory.
• Relevant industry experience can compensate for formal education requirements.
• Knowledge of networking fundamentals, operating systems, and databases is beneficial.

Skills

• Web Application Security: In-depth knowledge of web application vulnerabilities, common attack techniques, and mitigation strategies. Strong understanding of OWASP Top 10 vulnerabilities is crucial.
• Infrastructure security: Working knowledge of different on-prem and cloud builds (IaaS, PaaS, SaaS), in-depth understanding of operating systems and common flaws.
• Penetration Testing Techniques: Proficiency in various penetration testing methodologies, tools, and frameworks. Experience with manual testing, automated vulnerability scanners, and exploit frameworks is necessary.
• Analytical and Problem-Solving Skills: Ability to analyze complex web application environments, identify vulnerabilities, and recommend appropriate countermeasures.

Certifications

• CEH Certified Ethical Hacker
• OSCP Offensive Security Certified Professional
• PNPT Practical Network Penetration Tester
• Practical experience from bug bounty programs, CTFs, and real-world projects can be valuable