Junior Penetration Tester — Remote, Web & Cloud Security

Redherd.io; Johannesburg; Remote; ZAR 320,000 - 510,000; Full time

Job summary

Redherd.io is seeking a Junior to Mid-Level Security Analyst / Penetration Tester to join a growing offensive security team. The role focuses on hands-on testing across web apps, APIs, infrastructure, cloud platforms, and mobile apps, with learning opportunities in technique development and reporting.

You will work with experienced testers to perform real-world assessments, identify vulnerabilities, and contribute to remediation guidance for clients in regulated industries.

Qualifications

• 1–3+ years of experience in penetration testing, vulnerability assessment, or offensive security related work.
• Foundational understanding of web application security concepts and OWASP Top 10 vulnerabilities.
• Familiarity with penetration testing tools such as Burp Suite, Nmap, Kali Linux, or similar security tooling.

Responsibilities

• Assist in performing penetration tests across web applications, APIs, mobile applications, infrastructure environments, and cloud systems.
• Identify and validate security vulnerabilities such as authentication flaws, insecure access controls, and common OWASP vulnerabilities.
• Document testing activities and maintain clear testing notes and evidence; assist in preparing technical reports with remediation guidance.
• Stay current with emerging vulnerabilities, tools, and attack techniques.

Skills

Penetration testing

Web app security

OWASP Top 10

Burp Suite

Nmap

Kali Linux

Python

Bash

PowerShell

Tools

Burp Suite

Nmap

Kali Linux

PowerShell

Job description

Redherd.io is seeking a Junior to Mid-Level Security Analyst / Penetration Tester to join a growing offensive security team. The role focuses on hands-on testing across web apps, APIs, infrastructure, cloud platforms, and mobile apps, with learning opportunities in technique development and reporting.

You will work with experienced testers to perform real-world assessments, identify vulnerabilities, and contribute to remediation guidance for clients in regulated industries.