Penetration Tester

OVA.Work; New York (NY); Hybrid; USD 110,000 - 180,000; Full time

Job summary

OVA.Work is seeking a Penetration Tester (Ethical Hacker) to identify and remediate security vulnerabilities across apps, networks, and cloud environments. The role includes authorized tests and real-world attack simulations to strengthen the organization’s defenses.

The ideal candidate has strong offensive security knowledge, vulnerability management experience, and the ability to deliver actionable reports with clear risk ratings and remediation guidance for technical and non-technical

Qualifications

• Experience performing authorized security assessments and penetration tests.
• Familiarity with OWASP Top 10 and MITRE ATT&CK frameworks.
• Ability to document findings with clear risk ratings and remediation guidance.
• Experience with agile, DevSecOps, and secure SDLC practices.

Responsibilities

• Conduct penetration tests on web apps, APIs, mobile apps, networks, cloud environments.
• Perform vulnerability assessments and security audits to identify weaknesses.
• Simulate real-world attack scenarios to evaluate controls.
• Analyze findings and deliver detailed reports with remediation guidance.
• Validate fixes through retesting.
• Review system architectures for security.
• Assist teams in implementing security best practices.
• Conduct reconnaissance, threat modeling, and attack surface analysis.
• Stay informed about emerging threats and techniques.
• Support red team exercises and security awareness initiatives.
• Ensure testing complies with legal and regulatory requirements.

Skills

Cybersecurity fundamentals

Web security testing

Network security testing

Cloud security testing

Analytical skills

Report writing

Stakeholder communication

Education

Bachelor's degree in Cybersecurity / Information Security / CS

Tools

Burp Suite

OWASP ZAP

Nessus

Nmap

Metasploit

Qualys

Rapid7

Tenable

Python

PowerShell

Bash

Job description

Job Summary

We are seeking a skilled Penetration Tester to identify, assess, and help remediate security vulnerabilities across applications, networks, cloud environments, and enterprise systems. The ideal candidate will perform authorized security assessments, simulate real-world cyberattacks, and provide actionable recommendations to strengthen the organization's security posture. This role requires a deep understanding of offensive security techniques, vulnerability management, and security best practices.

Job Title

Penetration Tester (Ethical Hacker)

Job Summary

We are seeking a skilled Penetration Tester to identify, assess, and help remediate security vulnerabilities across applications, networks, cloud environments, and enterprise systems. The ideal candidate will perform authorized security assessments, simulate real-world cyberattacks, and provide actionable recommendations to strengthen the organization's security posture. This role requires a deep understanding of offensive security techniques, vulnerability management, and security best practices.

Key Responsibilities

• Conduct penetration tests on web applications, APIs, mobile applications, networks, cloud environments, and infrastructure.
• Perform vulnerability assessments and security audits to identify weaknesses.
• Simulate real-world attack scenarios to evaluate security controls and defenses.
• Analyze findings and provide detailed reports with risk ratings and remediation recommendations.
• Validate vulnerability fixes through retesting activities.
• Conduct security reviews of system architectures and application designs.
• Assist development and infrastructure teams in implementing security best practices.
• Perform reconnaissance, threat modeling, and attack surface analysis.
• Stay informed about emerging threats, vulnerabilities, and attack techniques.
• Support red team exercises and security awareness initiatives.
• Ensure testing activities comply with legal, regulatory, and organizational requirements.

Required Skills

• Strong understanding of cybersecurity principles and attack methodologies.
• Experience with web application, network, and cloud security testing.
• Knowledge of common vulnerabilities such as OWASP Top 10 and MITRE Telecommunication&CK.
• Strong analytical and problem-solving skills.
• Ability to communicate technical findings to both technical and non-technical stakeholders.
• Experience writing professional penetration testing reports.

Technical Skills

• Security Testing Tools: Burp Suite, OWASP ZAP, Nessus, Nmap, Metasploit
• Web Application Security Testing
• API Security Testing
• Mobile Security Testing (Android/iOS)
• Network Security Assessment
• Cloud Security (AWS, Azure, GCP)
• Operating Systems: Linux, Windows
• Scripting Languages: Python, PowerShell, Bash
• Vulnerability Management Tools: Qualys, Rapid7, Tenable
• Security Frameworks: OWASP, NIST, CIS Controls, MITRE Telecommunication&CK

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field.
• Professional certifications are highly preferred:
  • CEH (Certified Ethical Hacker)
  • OSCP (Offensive Security Certified Professional)
  • GPEN (GIAC Penetration Tester)
  • PNPT (Practical Network Penetration Tester)
  • CISSP (Preferred)

Experience

• 37 years of experience in Penetration Testing, Ethical Hacking, Red Teaming, or Cybersecurity.
• Hands-on experience conducting application, network, and cloud security assessments.
• Experience using industry-standard penetration testing tools and methodologies.
• Familiarity with Agile, DevSecOps, and Secure SDLC practices.

Preferred Qualifications

• Experience with Red Team and Purple Team engagements.
• Knowledge of Active Directory security and privilege escalation techniques.
• Experience with container and Kubernetes security assessments.
• Understanding of cloud-native security controls and architecture.
• Experience performing source code security reviews and secure coding assessments.

Preferred Qualities

• Strong investigative and analytical mindset.
• High attention to detail and commitment to ethical standards.
• Excellent report writing and presentation skills.
• Ability to work independently and collaboratively.
• Passion for cybersecurity research and continuous learning.

Employment Type

Full-Time

Location:

Remote / Hybrid / On-site

Nice To Have

• Experience with bug bounty programs and responsible disclosure processes.
• Knowledge of Security Operations Center (SOC) workflows and incident response.
• Familiarity with threat intelligence platforms and threat hunting.
• Experience testing enterprise SaaS, FinTech, Healthcare, Government, or Cloud-native applications.
• Contributions to cybersecurity research, security blogs, open-source tools, or conference presentations.