Requirements

What you'll work on:

• Conduct scoped vulnerability assessments and penetration tests
• Perform manual validation and exploitation, not only automated scanning
• Document findings, business impact, evidence and practical remediation
• At senior levels, design red-team scenarios and lead client-facing engagements
• Work with defensive teams to improve prevention and detection

What you bring:

• Hands-on authorised testing experience across one or more of web applications, APIs, infrastructure, Active Directory, wireless, mobile or cloud environments
• Strong understanding of OWASP guidance, common attack paths, vulnerability classes and safe rules of engagement
• Ability to combine automated tooling with manual validation, exploitation and business-impact analysis
• Proficiency with common testing toolsets and scripting in Python, PowerShell, Bash or a comparable language
• Ability to produce clear, reproducible findings with evidence, severity rationale and practical remediation advice
• Understanding of operational security, data handling, legal boundaries and controlled test execution
• For red-team candidates, experience planning adversary scenarios, command-and-control operations, lateral movement and detection-evasion testing
• For senior candidates, experience scoping engagements, leading delivery and presenting findings to technical and executive stakeholders.

Required certifications:

Mid-level and Senior: at least one recognised practical certification, such as OSCP, OSWA, OSWE, GPEN, GWAPT, CRTO or equivalent

Senior red-team roles may require an advanced certification such as OSEP, OSED, OSCE3, GXPN or equivalent

Nice to have:

• OSCP, OSWA/OSWE, GPEN, GWAPT, CRTO or equivalent practical capability
• Purple-team, exploit-development or social-engineering experience where authorised