Penetration Tester

Cybersecurity Jobs; Kansas City (MO); On-site; USD 110,000 - 150,000; Full time

Job summary

Deloitte Technology in Kansas City, MO is seeking a Penetration Tester to perform hands-on testing across web, API, AI/LLM, network, mobile, and thick client environments onsite. The role emphasizes leveraging AI/LLM capabilities to speed reconnaissance and testing and to deliver clear client findings.

Applicants should have substantial experience with Kali Linux, Burp Suite Pro, Metasploit, NMAP, and related tools, plus a track record with diverse stakeholders and strong communication skills.

Qualifications

• Experience with Kali Linux or another dedicated penetration testing OS.
• Familiarity with OWASP Top 10 software weaknesses and vulnerabilities.
• Knowledge of common testing tools and AI/LLM tooling is a plus.
• Ability to work with diverse stakeholders and manage multiple initiatives.

Responsibilities

• Execute penetration testing engagements across web, API, AI/LLM, network, mobile, and thick client environments.
• Deliver Web Application, Web Services/API, Network, Mobile, and Thick Client testing.
• Provide consultative guidance on findings in writing and verbally to clients.
• Enhance testing methodologies, processes, and standards in the team.
• Leverage AI/LLM tools to accelerate reconnaissance and generate testing scripts.
• Build and maintain AI-driven agents to automate recurring tasks and reduce false positives.

Skills

Strong communication

Multitasking

Global stakeholder experience

Education

CEH

OSCP

GIAC certifications (GSEC, GWAB, GPEN, GMOB, GCPN)

Tools

Kali Linux

Burp Suite Pro

AMASS

Metasploit

Postman

Swagger

NMAP

Qualys

SQLMap

Anthropic / OpenAI tooling

Obsidian

Ollama

Job description

Deloitte Global cyber services is looking for a Penetration Tester to deliver penetration testing services as part of its cybersecurity team. This onsite role in Kansas City, MO focuses on executing assessments across multiple environments, including web, API, AI/LLM, network, mobile, and thick client engagements, while leveraging AI/LLM capabilities to improve efficiency in reconnaissance and testing.

What you’ll do

• Execute penetration testing engagements including Web Application Penetration Testing
• Conduct Web Services / API Penetration Testing for application and service interfaces
• Perform AI/LLM Penetration Testing using AI/LLM approaches to support testing activities
• Run Network Penetration Testing engagements against network-facing systems
• Deliver Mobile Application Penetration Testing assessments
• Execute Thick Client Penetration Testing where applicable
• Provide consultative guidance to customers on findings in a clear and actionable manner, delivered both in writing and verbally
• Enhance and update testing methodologies, processes, and standards documentation
• Use AI and LLM-based tools and prompt engineering to accelerate reconnaissance and generate or refine testing scripts
• Build, customize, and maintain AI-driven agents to automate recurring testing tasks
• Continuously validate the accuracy and reliability of self-developed AI tools, working to reduce hallucinations and false positives in vulnerability identification
• Evaluate and integrate emerging AI-assisted offensive security tooling into team methodology and playbooks
• Analyze and understand complex architecture designs
• Communicate the services and capabilities the group can facilitate for clients

Required qualifications

• Experience with Kali Linux or another dedicated penetration testing OS platform
• Knowledge of common testing tools such as Burp Professional, AMASS, Metasploit, Postman, Swagger, NMAP, Qualys, SQLMap, and others
• Familiarity with OWASP Top 10 software security weaknesses and vulnerabilities
• Familiarity with AI models and frameworks from providers such as Anthropic and OpenAI, plus experience configuring tools like Obsidian and Ollama is a plus for supporting other workflows
• Working knowledge of one scripting language and familiarity with at least one software programming language and framework
• Demonstrated experience working with diverse stakeholders, preferably on a global multi-national basis
• Ability to manage concurrent initiatives, using sound judgment for prioritization and time management
• Strong written and verbal communication skills
• Must be a US Citizen

Technologies you may work with

• Kali Linux
• Burp Professional
• AMASS
• Metasploit
• Postman
• Swagger
• NMAP
• Qualys
• SQL Map
• Anthropic
• OpenAI
• Obsidian
• Ollama
• OWASP Top 10
• AI/LLM
• Prompt engineering

Team context

Deloitte Technology works at the forefront of technology development and processes to support and protect Deloitte around the world.

Preferred

• Certified Ethical Hacker (CEH)
• Offensive Certified Security Professional (OSCP)
• Any GIAC certification (GSEC, GWAB, GPEN, GMOB, GCPN)
• OWASP Application Security Top 10
• OWASP API Security Top 10
• OWASP Thick Client Top 10
• OWASP LLM Top 10
• MITRE ATT&CK Framework
• Cloud service testing
• Reverse engineering
• SAST
• DAST
• Experience of agentic development and applying it to support penetration testing