Senior Penetration Testers

Do you feel like scanners are just to catch the low-hanging fruit and that the real findings are left for the human testers? Have you tested hundreds of networks and still want more? If this describes you, you’re in luck! We are looking for an experienced penetration security testers to join our team of highly skilled penetration testers. If you feel most at home with a scanner and manually following up on those vulnerabilities, this is NOT the kind of job we are offering. Minimum Requirements -Advanced ability to detect, define, exploit, and remediate vulnerabilities without the use of a vulnerability scanner (a browser, a proxy, an editor, and YOU) Develop detailed reports on findings and remediations – Familiarity with Windows Internals – Vulnerability and exploit development research – Evade EDR devices such as Windows Defender and Cybereason,Crowdstrike to avoid detection by defenders/behavioral-based alerting to further the engagement objectives – Conduct open-source intelligence gathering, network vulnerability scanning, exploitation of vulnerable services, lateral movement, install persistence in a target network(s), and manage C2 infrastructure – Develop payloads, scripts, and tools that weaponize new proof-of-concepts for exploitation, evasion, and lateral movement – Communicate effectively with team members during an engagement – Ability to think unconventionally to develop adversarial TTPs – Keep current with TTPs and the latest offensive security techniques You should know your way around the common professional exploitation frameworks (e.g. Core Impact, Canvas, Metasploit) and have a strong working knowledge of exploitation outside the typical “click to exploit” type of testing. We are not asking if you can scan something and only attempt an exploit in msf/Core/Canvas. You should have full working knowledge of Kali Linux or similar testing distributions and most of the tools. Experience with penetration testing as a consultant is preferred. We believe that writing reports are just as important as finding flaws, so you should be able to communicate professionally and write clear and concise reports. Though not required, the following certifications would be considered nice to have: CISSP, CISA, OSCP, OSWP, OSCE, OSEE, OSWE, any of the GIAC certs, CEH, LTP, etc. If you are looking for a straight 9-5 job, you’re probably better off looking elsewhere. We work hard and play even harder. We expect you to live your life and enjoy it, but we also want you to have just as much fun working with the team and our list of clients. We are a family and treat each employee AND client as a member of that family.