Senior Penetration Tester – Offensive Security Specialist

JazzWorld; Karachi Division; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

TPL Insurance in Karachi seeks an experienced Penetration Tester to conduct authorized testing across networks, apps, APIs, and cloud environments, identify vulnerabilities, and guide remediation efforts.

The role requires 5–8 years of hands-on testing, relevant certifications (OSCP, CREST, CEH, PenTest+), and strong analytical and communication skills to translate risk to both technical and non-technical stakeholders.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Software Engineering.
• 5-8 years of hands-on experience in penetration testing or offensive security (advisory/consultancy desirable).
• OSCP, CREST PT, CEH, PenTest+, GPEN certifications preferred/desirable.

Responsibilities

• Plan and execute authorized penetration tests across internal and external networks, web apps, APIs, infrastructure, endpoints.
• Perform vulnerability assessments and validate findings.
• Identify exploitable vulnerabilities and assess business impact.
• Conduct authenticated and unauthenticated security testing as applicable.
• Maintain documentation and evidence of testing activities and findings.
• Prepare detailed penetration testing reports with remediation recommendations.

Skills

Penetration testing

Vulnerability assessment

Offensive security

Analytical thinking

Communication skills

Education

Bachelor’s degree in Cybersecurity / Information Security / Computer Science / IT / Software Engineering

Tools

OSCP

CREST CP测试

Job description

TPL Insurance in Karachi seeks an experienced Penetration Tester to conduct authorized testing across networks, apps, APIs, and cloud environments, identify vulnerabilities, and guide remediation efforts.

The role requires 5–8 years of hands-on testing, relevant certifications (OSCP, CREST, CEH, PenTest+), and strong analytical and communication skills to translate risk to both technical and non-technical stakeholders.