Senior Penetration Tester

Overview

We are seeking an experienced Senior Penetration Tester to enhance our security testing team. This role involves conducting thorough manual penetration testing engagements across various platforms including web applications, mobile devices, infrastructure, cloud environments, VoIP, and Wi-Fi networks, servicing both internal teams and clients throughout the UAE. The function requires compliance with formal testing methodologies and delivering detailed, professional reports ready for client review.

Key Responsibilities

• Perform manual and tool-supported penetration assessments on web applications, web services, mobile apps (iOS and Android), infrastructure, cloud setups, VoIP, and Wi-Fi platforms, focusing on both external and internal vulnerabilities.
• Conduct penetration testing based on Greybox, Whitebox, and Blackbox methodologies.
• Work strictly within authorized rules of engagement and exploit approval guidelines prior to any exploitation efforts.
• Immediately escalate critical security findings, including remote code execution and SQL injection vulnerabilities, beyond regular reporting timelines.
• Develop comprehensive, client-focused reports that include executive summaries, business impacts, detailed findings with severity levels, affected assets, root causes, evidence, and mitigation recommendations.
• Maintain and update vulnerability registers and input findings into vulnerability management systems where integration is available.
• Retest resolved vulnerabilities to validate fixes and issue formal closure or certification reports.
• Contribute to monthly status reports and dashboards tracking active engagements.
• Lead discussions and review sessions of findings with client stakeholders in fluent English.
• Clarify and demonstrate reported vulnerabilities upon request.
• Ensure quality assurance by reviewing both personal and colleagues' outputs to prevent false positives and negatives prior to report finalization.

Candidate Profile and Requirements

• Minimum of four years' hands-on penetration testing experience.
• Proficient in at least two domains among web/API security testing, mobile application testing (iOS/Android), network/infrastructure security, and cloud security (AWS/Azure).
• Experienced with manual testing techniques and common security tools such as Burp Suite, Acunetix, and Nmap.
• Strong command of English, both verbal and written, with the confidence to present findings to both technical teams and executives.
• Familiarity with formal engagement governance including scope adherence, exploit authorizations, and escalation procedures.
• Based in Dubai or willing to relocate, with the flexibility to travel to client sites as needed.

Education and Certifications

• Preferred certifications include OSCP, OSCE, OSWE, GPEN, or other recognized offensive security qualifications.
• Additional certifications in cloud or network security such as AWS or Azure are advantageous.
• Bachelor's degree in Computer Science, Information Security, or related disciplines, or equivalent practical experience.
• Must have an unblemished background suitable for formal identity, legal work status, educational, and employment verification.