Penetration Tester

Job Title: Penetration Test Engineer

Location: Bangalore

Experience Required: 3 to 10 Years

Employment Type: Full-Time

Role Overview:

We are looking for a skilled Penetration Test Engineer to join our security team and lead or support penetration testing initiatives across cloud, web, mobile, and AI/ML applications. You will be responsible for identifying vulnerabilities, assessing risk, and recommending remediation strategies. Candidates with strong technical expertise and hands-on experience in offensive security, scripting, and modern testing tools will thrive in this role.

Key Responsibilities:

• Conduct internal and external penetration testing for cloud, web, and mobile applications.
• Perform Dynamic Application Security Testing (DAST) using tools such as Burp Suite and OWASP ZAP.
• Investigate and validate Static Application Security Testing (SAST) findings through code reviews.
• Lead or contribute to AI/ML application security assessments and testing automation.
• Identify, document, and report vulnerabilities along with detailed remediation guidance.
• Write custom scripts and tools in Python to support exploitation and automation.
• Analyze application code in Ruby, Ruby on Rails, and Scala to uncover potential risks.
• Use AI/ML-based tooling to support vulnerability triage and analysis (optional but preferred).
• Ensure alignment with regulatory standards such as PCI-DSS (especially for senior candidates).

Required Skills & Qualifications:

• 3 to 10 years of hands-on experience in penetration testing, preferably across cloud environments.
• Experience with Burp Suite, OWASP ZAP, and other offensive security tools.
• Proficiency in reading and analyzing code in Ruby, Ruby on Rails, and Scala.
• Strong scripting skills in Python, with the ability to create custom exploitation tools.
• Exposure to AI/ML security testing and tooling is an added advantage.
• Experience working with PCI compliance and cloud security frameworks (for senior-level candidates).

Preferred Qualifications:

• Relevant certifications such as OSCP, OSWE, GWAPT, or CPT.
• Knowledge of modern DevSecOps practices and integration of security into CI/CD pipelines.