Senior Penetration Tester | Sa

Redherd.Io; Johannesburg; Remote; ZAR 600,000 - 900,000; Full time

Job summary

Redherd.Io is seeking a Security Analyst / Penetration Tester to join a growing offensive security team. The role focuses on delivering high-quality testing across web applications, APIs, mobile platforms, infrastructure, and cloud environments, using manual testing and deep technical analysis to find vulnerabilities beyond automated scans.

You will develop proof-of-concept exploits, produce clear remediation guidance, and present findings to technical and business stakeholders.

Qualifications

• 2–6+ years of hands-on penetration testing experience.
• Strong knowledge of OWASP Top 10, ASVS, and API Security Top 10.
• Experience with manual testing and vulnerability chaining.
• Proficient with security testing tools and scripting.
• Strong written reporting and client communication skills.

Responsibilities

• Lead penetration testing engagements from planning through reporting and remediation guidance.
• Produce clear reports with risk ratings and remediation advice.
• Present findings to technical and business stakeholders.
• Develop proof-of-concept exploits and validate fixes.

Skills

Penetration testing

Manual testing

Vulnerability assessment

Threat hunting

Reporting

Tools

Burp Suite

Nessus

Metasploit

Python scripting

Job description

Security Analyst (Penetration Testing)

Location: Remote (South Africa) | Ideally GP
Type: Permanent | Mid to Senior Level

About Redherd

Redherd is a specialist cybersecurity recruitment and advisory firm working globally with security consultancies, product companies, and technology organisations. We partner closely with technically strong teams to identify high-impact security talent across offensive security, cloud security, vulnerability research, and threat intelligence.

About the Client

Our client is a respected cybersecurity consultancy delivering offensive security and cyber threat intelligence services to organisations across regulated industries including financial services, retail, and technology. The team works with clients both locally and internationally and operates with a strong emphasis on technical quality, research, and professional development.

Role Overview

We are seeking a Security Analyst / Penetration Tester to join a growing offensive security team. This role focuses on delivering high-quality penetration testing engagements across web applications, APIs, mobile platforms, infrastructure environments, and cloud systems.

The position is suited to security professionals who enjoy manual testing, deep technical analysis, and vulnerability discovery beyond automated scanning.

You will work across diverse client environments, performing security assessments, developing proof-of-concept exploits, and producing clear remediation guidance that helps organisations reduce real-world risk.

Security Testing & Research

• Perform manual penetration testing across web applications, APIs, mobile platforms, infrastructure environments, and cloud systems.
• Identify and validate vulnerabilities including business logic flaws, authentication bypasses, and exploit chains.
• Conduct external and internal infrastructure testing, including network and Active Directory environments.
• Perform cloud security assessments across platforms such as AWS and Azure.
• Develop scripts or tooling to support testing workflows and improve efficiency.

Client Delivery

• Lead penetration testing engagements from planning through reporting and remediation guidance.
• Produce clear reports with risk ratings and practical remediation advice.
• Present findings to both technical and business stakeholders.

Team Collaboration

• Contribute to internal tooling, playbooks, and research initiatives.
• Mentor junior analysts and share knowledge within the team.
• Support occasional pre-sales activities, scoping discussions, and technical demonstrations.

Required Experience

• 2–6+ years of hands-on penetration testing experience.
• Strong understanding of OWASP Top 10, ASVS, and API Security Top 10.
• Experience performing manual testing and vulnerability chaining.
• Proficiency with security testing tools and scripting.
• Strong written reporting and client communication skills.

Nice to Have

• Certifications such as OSCP, CREST CRT/CPSA, GPEN, GXPN, OSWE, OSEP, eWPT/eWPTX.
• Experience with cloud security, containers, Kubernetes, or CI/CD security.
• Exposure to red teaming or intelligence-led testing.
• Experience working within regulated environments (ISO 27001, PCI DSS).
• Participation in CTFs, research, or open-source security projects.