Penetration Testing Analyst

Sun Life Global Solutions – Philippines; Taguig; On-site; PHP 600,000 - 1,200,000; Full time

Job summary

Sun Life Global Solutions – Philippines is seeking a Penetration Testing Analyst to perform hands-on security testing of applications, infrastructure, and systems. This role focuses on penetration testing delivery with secondary exposure to Red Team activities.

The successful candidate will bring strong technical testing skills and a drive to develop broader offensive security capabilities, collaborating with the security team to identify vulnerabilities, assess risk, and produce clear

Qualifications

• 2+ years of hands-on testing in web app, API, and basic network testing.
• Solid understanding of authentication, session management, and access control flaws.
• Experience with Burp Suite, Nmap, and sqlmap or similar tools.
• Ability to perform manual testing beyond automated scanning and to report risks clearly.
• Bachelor's degree in Computer Science or Information Security; OSCP/ CISSP or similar desirable but not required.

Responsibilities

• Perform web, API, mobile, and infrastructure penetration testing across enterprise applications.
• Identify, exploit, and validate vulnerabilities with manual testing techniques and industry tools.
• Conform to OWASP guidelines and established security frameworks.
• Produce clear, structured reports outlining vulnerabilities, root cause, risk, and remediation recommendations.
• Research new vulnerabilities and attack techniques to enhance testing coverage.
• Support re-testing and validation of remediation efforts.
• Support Red Team activities and surface mapping; document attack paths and gaps.
• Assist in controlled exploitation activities under guidance.

Skills

Web security testing

API security testing

Network security basics

Authentication & access control

Manual testing

Education

Bachelor's degree in Computer Science or Information Security

Tools

Burp Suite

Nmap

sqlmap

Job description

At Sun Life, we work together, share common values, and encourage growth and achievement. We are seeking a skilled Penetration Testing Analyst to perform hands‑on security testing of applications, infrastructure, and systems.

This role is primarily focused on Penetration Testing delivery, with secondary exposure to Red Team activities, contributing to adversary simulation exercises where required. The successful candidate will have strong technical testing capabilities, with an interest in developing broader offensive security skills.

Key Responsibilities

• Perform web, API, mobile, and infrastructure penetration testing across enterprise applications.
• Identify, exploit, and validate security vulnerabilities using manual testing techniques and industry tools.
• Conduct testing in line with established methodologies and security frameworks (e.g., OWASP).
• Produce clear, structured reports outlining:
  • Vulnerabilities and root cause
  • Business impact and risk rating
  • Practical remediation recommendations
• Perform research into new vulnerabilities, exploits, and attack techniques to enhance testing coverage.
• Support re-testing activities to validate remediation of identified issues.
• Support Red Team activities where required.
• Contribute to reconnaissance and attack surface mapping, Identification of potential attack paths.
• Support documentation of attack paths and identified security gaps.
• Assist in controlled exploitation activities under guidance, including:
  • Initial access techniques
  • Limited post-exploitation validation (e.g., privilege escalation concepts, lateral movement awareness)

• Collaborate with senior team members to understand real‑world attacker behaviour and techniques.

Required Skills & Experience

Core Penetration Testing Skills (Essential)

• 2+ years of hands‑on experience in:
  • Web application security testing (OWASP Top 10)
  • API security testing
  • Basic network/infrastructure testing
• Strong understanding of:
  • Authentication, session management, and access control flaws
  • Input validation and injection vulnerabilities
• Experience with tools such as:
  • Burp Suite, Nmap, sqlmap, or similar
• Ability to perform manual testing beyond automated scanning.
• Strong documentation and reporting skills, with focus on clear risk articulation.

Red Teaming Skills (Desirable – Foundational Level)

• Basic understanding of adversary simulation concepts and attack lifecycle.
• Familiarity with:
  • Reconnaissance techniques
  • Common initial compromise methods
• Awareness of:
  • Privilege escalation and lateral movement concepts
  • Attack paths across enterprise environments
• Interest in developing Red Team and offensive security capabilities over time.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Certifications such as OSCP, OSWA, CISSP or CompTIA are desired but not required.