Senior Penetration Tester

Cytomate; Doha; On-site; QAR 240,000 - 360,000; Full time

Job summary

Cytomate in Doha, Qatar is seeking a Senior Penetration Tester to conduct comprehensive security assessments across web apps, networks, and AD environments. You will identify vulnerabilities, validate findings, and deliver remediation guidance to strengthen security posture.

The role requires 5+ years of experience, strong knowledge of application security testing, SAST/DAST, and reporting. Collaboration with cross-functional teams and periodic retesting are expected.

Qualifications

• Minimum 5 years of hands-on penetration testing experience.
• Strong experience in application security testing and risk reporting.
• Ability to conduct testing within defined scopes and rules of engagement.
• Excellent written and verbal communication for detailed reporting.

Responsibilities

• Penetration testing of web applications, APIs, and other application environments.
• Perform application security assessments using SAST and DAST tools.
• Conduct manual source code reviews to identify security flaws.
• Conduct internal and external network penetration testing to identify vulnerabilities.
• Perform Active Directory security assessments including enumeration and privilege escalation.
• Test thick-client and thin-client applications and their authentication.
• Conduct OSINT to identify exposed assets and attack surfaces.
• Identify, validate exploits, and document vulnerabilities with evidence.
• Assess authentication, authorization, session management, and access controls.
• Use standard tools and methodologies for security assessments.
• Prepare detailed reports with findings, risk ratings, PoCs, and remediations.
• Collaborate with dev, infra, and security teams for remediation.

Skills

Application Security

SAST/DAST

Source Code Analysis

Active Directory

Network Pen Testing

OSINT

Reporting

Retesting

OWASP Top 10

Education

Bachelor's degree in CS/Cybersecurity

Security certifications (adv)

Tools

Burp Suite

OWASP ZAP

Nmap

Metasploit

Mimikatz

CodeQL/Semgrep

Maltego

Job description

Job Description: Senior Penetration Tester

Job Title: Senior Penetration Tester

Department: Cybersecurity / Information Security

Experience: 5+ years of relevant experience (preferred)

Job Summary

We are seeking an experienced Senior Penetration Tester to conduct comprehensive security assessments across web applications, internal and external infrastructure, Active Directory environments, and client-server applications. The ideal candidate should have strong expertise in application security testing, source code analysis, SAST/DAST, network penetration testing, OSINT, and identifying and exploiting security vulnerabilities.

The candidate will be responsible for assessing security risks, validating vulnerabilities, recommending remediation measures, and preparing detailed technical reports to strengthen the organization’s overall security posture.

Key Responsibilities

• Conduct penetration testing of web applications, APIs, and other application environments.
• Perform application security assessments using SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools.
• Conduct manual source code reviews to identify security flaws, insecure coding practices, and potential vulnerabilities.
• Perform internal and external network penetration testing to identify vulnerabilities and assess potential attack paths.
• Conduct Active Directory security assessments, including enumeration, privilege escalation, misconfiguration analysis, and attack path identification.
• Perform penetration testing of thick-client and thin-client applications, including client-server communication and authentication mechanisms.
• Conduct Open-Source Intelligence (OSINT) activities to identify publicly exposed assets, information leakage, and potential attack surfaces.
• Identify, validate exploit, and document security vulnerabilities while following authorized testing procedures.
• Assess authentication, authorization, session management, access controls, and common application security weaknesses.
• Use industry-standard penetration testing tools and methodologies to perform security assessments.
• Prepare detailed penetration testing reports, including findings, risk ratings, proof of concept, business impact, and remediation recommendations.
• Work closely with development, infrastructure, and security teams to validate findings and support vulnerability remediation.
• Perform retesting to verify that identified vulnerabilities have been appropriately resolved.
• Follow recognized security standards and methodologies, including OWASP, PTES, and relevant MITRE ATT&CK techniques.

Required Technical Skills

• Application Security: Web application and API penetration testing, OWASP Top 10, authentication and authorization testing.
• SAST/DAST: Experience with security testing tools and interpretation of scan results.
• Source Code Analysis: Ability to review source code and identify security vulnerabilities.
• Active Directory: AD enumeration, privilege escalation, Kerberos-related attacks, misconfiguration analysis, and lateral movement techniques.
• Internal & External Penetration Testing: Network enumeration, vulnerability assessment, exploitation, and attack path analysis.
• Thick & Thin Client Testing: Experience assessing client-server applications, business logic, and communication protocols.
• OSINT: Publicly exposed asset discovery, reconnaissance, and information gathering.
• Reporting: Strong technical documentation, risk assessment, and remediation guidance skills.

Preferred Tools & Technologies

Experience with relevant tools such as:

• Application Security: Burp Suite Professional, OWASP ZAP, Postman.
• SAST/DAST: SonarQube, Checkmarx, Fortify, Veracode, or equivalent tools.
• Network Penetration Testing: Nmap, Nessus, Metasploit.
• Active Directory: BloodHound, Impacket, NetExec, Mimikatz.
• Source Code Analysis: Semgrep, CodeQL, and manual code review techniques.
• OSINT: Maltego, theHarvester, Amass, and other reconnaissance tools.
• Operating Systems: Kali Linux, Windows, and Linux server environments.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.
• Minimum 5 years of hands‑on penetration testing or offensive security experience preferred.
• Demonstrated experience in application security, infrastructure penetration testing, and Active Directory assessments.
• Strong understanding of common vulnerabilities, exploitation techniques, and security testing methodologies.
• Relevant certifications such as CRTP, CPTS, OSCP, PNPT, OSWE, GWAPT, or equivalent are an advantage.
• Excellent analytical, troubleshooting, communication, and report‑writing skills.
• Ability to work independently and conduct security assessments within defined scopes and rules of engagement.

Expected Deliverables

• Comprehensive penetration testing reports.
• Documented and validated security vulnerabilities with evidence.
• Risk‑based remediation recommendations.
• Retesting and remediation verification reports.
• Clear communication of technical risks and business impact.

Ideal Candidate:

A hands‑on senior penetration tester with strong expertise in application security, SAST/DAST, source code analysis, Active Directory, internal and external infrastructure, thick/thin client testing, and OSINT.

Location:

Doha, Qatar