Cyber Security (Offensive) Associate/Senior Associate (JP00359)

PwC Türkiye; Fatih; On-site; TRY 300,000 - 450,000; Full time

Job summary

PwC Türkiye is seeking an Associate/Senior Associate in Cyber Security (Offensive) to join a global team. You will perform red team testing across web, networks, APIs, mobile and cloud, applying a disciplined attacker mindset to identify real-world risks.

The role emphasizes hands-on use of Burp Suite, Metasploit, Nmap and other tools, adherence to MITRE ATT&CK and CIS controls, and clear regulatory reporting. English proficiency and collaboration are essential.

Qualifications

• Minimum 1-year relevant experience for Associate (3+ years for Senior Associate).
• Offensive-security certification such as OSCP, OSWE, CREST, GPEN, LPT, GXPN or GWAPT is required
• Having or willingness to obtain TSE (Turkish Standards Institution) Penetration Tester certification is a plus
• Hands-on experience with offensive tools and platforms (e.g., Burp Suite, Metasploit, NetExec, Cobalt Strike, Nmap) and Breach & Attack Simulation solutions
• Solid understanding of IT infrastructure fundamentals: networking, operating systems, databases and cloud
• Desirable: cloud infrastructure, container technologies, public cloud (AWS, Azure, GCP), ICS/OT, AI and blockchain experience
• Familiarity with frameworks and standards such as MITRE ATT&CK, NIST CSF, OWASP and CIS
• Proficient English (minimum B1), both written and oral
• Proactive, collaborative, impact-focused, and able to manage multiple tasks

Responsibilities

• Perform red team / purple team engagements and penetration tests across web applications, networks, APIs, mobile, ICS/OT and cloud environments
• Execute testing using a repeatable, methodology-driven approach: threat modelling, controlled exploitation, validation and impact assessment
• Produce detailed, regulatory-compliant reports (e.g., SPK, BDDK) with clear findings and actionable remediation guidance
• Support clients in reducing risk and improving security posture against real-world attack scenarios
• Contribute to service development and work closely with the broader PwC Offensive Security network and global experts

Skills

Offensive security

Burp Suite

Metasploit

Nmap

Cloud platforms

MITRE ATT&CK

English (B1)

Threat modelling

CIS/NIST/OWASP

Team collaboration

Tools

Burp Suite

Metasploit

Cobalt Strike

Nmap

NetExec

Job description

At PwC, our purpose is to build trust in society and solve important problems

We’re a network of firms in 149 countries with more than 370,000 people who are committed to delivering quality in assurance, advisory and tax services. PwC has been providing services to the Turkish business world since 1981, with a professional staff of 1700 in İstanbul, Ankara, Bursa, İzmir and Eskişehir.

At PwC, we are a group of employees with a rich variety of knowledge, skills and competencies. PwC’s problem-solving teams come together in unusual, untraditional new ways from various disciplines to create The New Equation strategy. The New Equation is our global strategy with a human-centered and tech-powered approach, that focuses on our clients and all stakeholders, and helps them build trust and drive sustainable results.

Cyber Security (Offensive) Associate/Senior Associate

What are we looking for?

• Minimum 1-year relevant experience for Associate (3+ years for Senior Associate)
• An offensive-security practitioner who thinks like an attacker and follows a disciplined, repeatable methodology to identify, validate and communicate real-world risks
• Possession of an industry-recognized offensive-security certification such as OSCP, OSWE, CREST, GPEN, LPT, GXPN or GWAPT is required
• Having or willingness to obtain TSE (Turkish Standards Institution) Penetration Tester certification is a plus
• Hands‑on experience with offensive tools and platforms (e.g., Burp Suite, Metasploit, NetExec, Cobalt Strike, Nmap) and Breach & Attack Simulation solutions
• Solid understanding of IT infrastructure fundamentals: networking, operating systems, databases and cloud
• Desirable: cloud infrastructure, container technologies, public cloud (AWS, Azure, GCP), ICS/OT, AI and blockchain experience
• Familiarity with frameworks and standards such as MITRE ATT&CK, NIST CSF, OWASP and CIS
• Proficient English (minimum B1), both written and oral
• Proactive, collaborative, impact-focused, and able to manage multiple tasks

Role Description

• Perform red team / purple team engagements and penetration tests across web applications, networks, APIs, mobile, ICS/OT and cloud environments
• Execute testing using a repeatable, methodology-driven approach: threat modelling, controlled exploitation, validation and impact assessment
• Produce detailed, regulatory-compliant reports (e.g., SPK, BDDK) with clear findings and actionable remediation guidance
• Support clients in reducing risk and improving security posture against real-world attack scenarios
• Contribute to service development and work closely with the broader PwC Offensive Security network and global experts

--