Penetration Tester

OSec, Inc.; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Ocean Systems Engineering Corporation seeks a hands-on security tester to cover web, mobile, cloud, and network targets. Remote or from one of our offices, you’ll bring breadth across common targets with depth in at least one specialty.

You’ll deliver actionable reports, defend your methods (OWASP, PTES, NIST), and grow through original research or a strong portfolio.

Qualifications

• Hands-on testing across multiple targets (web, network, API, cloud, or mobile).
• Real manual exploitation skills beyond scanners.
• A defendable methodology (OWASP, PTES, NIST) with judgment to know when to override it.
• Clear client-facing reports that drive fixes.
• Proof you can do the work: OSCP or equivalent, a portfolio, or a track record.
• A specialty you go deep on: cloud, mobile, hardware, or application logic.
• Original research, CVE, or tooling you’ve published.
• A knack for learning a new target type fast.

Responsibilities

• Scope and run penetration tests across varied targets: web and mobile apps, networks, APIs, cloud, and whatever the engagement puts in front of you.
• Test past the point automated tooling gives up. The interesting bugs need a human.
• Chain findings into real impact, then write them up so the fix is obvious.
• Pick up new target types and specialties as clients need them. The field never sits still.
• Feed what works back to the bench and the platform.

Skills

Hands-on testing

Manual exploitation

Clear reporting

Portfolio experience

Education

OSCP or equivalent

Tools

Vulnerability scanners

Manual testing tools

Job description

Hands-on testing across web, network, cloud, mobile, and more: the manual work that starts where a scanner stops.

This is where OSec started, seniors breaking in for people who needed to know what a real attacker could reach. We test across every kind of target, and we go deep. You’ll bring breadth across the common ones and real depth in at least one, then keep adding specialties as the work demands. Every finding you prove makes the bench and the platform sharpen.

What you’ll do

• Scope and run penetration tests across varied targets: web and mobile apps, networks, APIs, cloud, and whatever the engagement puts in front of you.
• Test past the point automated tooling gives up. The interesting bugs need a human.
• Chain findings into real impact, then write them up so the fix is obvious.
• Pick up new target types and specialties as clients need them. The field never sits still.
• Feed what works back to the bench and the platform.

What you bring

• Solid hands-on testing across more than one target class (web, network, API, cloud, or mobile).
• Real manual exploitation skill, not just running and reading a scanner.
• A methodology you can defend (OWASP, PTES, NIST) and the judgment to know when to leave it.
• Clear reporting the client can act on. The report is the product they keep.
• Proof you can do the work: OSCP or equivalent, a portfolio, or a track record.
• A specialty you go deep on: cloud, mobile, hardware, or application logic.
• Original research, a CVE, or tooling you’ve published.
• A knack for learning a new target type fast.

The setup

Remote or in one of our offices, wherever you do your best work. Independent, which keeps us answering to the work and the people we do it for. We hire slowly and keep people a long time.