You find security weaknesses in web applications, APIs and infrastructure and help teams fix them.
Key Responsibilities
- Plan and carry out authorised penetration tests on web, API and cloud targets
- Test against the OWASP Top 10 and other recognised guidance
- Write up findings with clear risk ratings and fix guidance
- Retest after fixes and support developers
- Keep up with new vulnerabilities and techniques
Required Skills
- Practical experience with web and API security testing
- Familiarity with tools such as Burp Suite and Nmap
- Scripting skills (Python or Bash)
- Strong report writing and a responsible, ethical approach
Nice to Have
- An offensive security certification
- Cloud or mobile testing experience
Tools and technologies: Burp Suite; Nmap; Python or Bash; OWASP Top 10
How to prepare
- Be ready to explain how you would test an API for broken access control
- Bring a sanitised sample of a report you wrote