This role involves assessing the security of applications, networks, and systems through structured penetration testing and vulnerability assessments. You will identify weaknesses, document findings, and provide actionable recommendations to strengthen clients’ security defenses. The position is part of a team that turns complex security requirements and compliance frameworks into working infrastructure and services.
Responsibilities
Execute comprehensive penetration tests across web, mobile, network, and system environments to uncover, exploit, and validate critical infrastructure and application vulnerabilities
Produce high-fidelity technical reports mapping out exploit impact and proof-of-concept chains, translating complex risk metrics into actionable remediation roadmaps for clients
Partner directly with client engineering teams to guide post-assessment remediation, troubleshoot implementation blocks, and systematically verify the integrity of deployed fixes
Engineer custom testing scripts, automation tools, and offensive methodologies to continuously expand vulnerability discovery coverage and testing precision
Deploy tactical social engineering simulations, including targeted phishing and pretexting campaigns, to rigorously audit human security awareness and organizational defenses
Support active incident response loops by providing offensive technical expertise, investigating compromise vectors, and accelerating threat containment pipelines
Own the supporting client experience by maintaining transparent communications, gathering environmental prerequisites, and breaking down testing footprints into clear, business-friendly milestones
Track the evolving threat landscape to continuously integrate cutting-edge exploit techniques, active vector changes, and defensive counter-measures into live assessment playbooks
Requirements
Active offensive security operator with a proven history of executing structured penetration tests, vector mapping, and threat validation across complex application, network, and system environments
Master of offensive frameworks, having deployed industry-standard testing platforms, exploitation architectures, and reporting frameworks to uncover hidden systemic security vulnerabilities
Surgical exploit and validation engineer, having exploited, classified, and cataloged multi-tier security vulnerabilities, providing clear remediation roadmaps to client engineering teams to securely validate system fixes
Precision technical author, having formulated high-fidelity assessment documentation, exploit chain proofs, and detailed impact reports that translate complex threat data into highly structured, actionable guidance
High-impact security diplomat, able to articulate tactical risk scenarios, testing footprints, and remediation expectations with professional clarity to both deep technical infrastructure teams and executive client stakeholders
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Social engineering and automation developer, having engineered custom testing scripts, targeted phishing simulations, and pretexting campaigns to audit human security awareness and expand overall assessment coverage
Autonomous remote operator, commanding an advanced local testing station fully optimized for heavy virtual machine deployment, maintaining peak operational velocity during standard US Eastern Time working hours
Validated offensive security specialist, holding or actively pursuing high-value technical designations such as OSCP, CEH, or equivalent credentials that demonstrate a rigorous commitment to offensive security practices
Excellent written and verbal English communication skills, with the ability to engage confidently with candidates, hiring managers, and business leaders across global teams
A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, virtual interviews, and uninterrupted collaboration
Commitment to working a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time (ET) to effectively collaborate with team members, stakeholders, and cross-functional partners while ensuring timely communication and support
Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed
Nice to have:
Advanced cloud security auditing, including direct execution of cloud infrastructure penetration tests, container security evaluations, and environment configuration audits within AWS, GCP, or Azure
Integration of GRC compliance frameworks, with practical alignment of technical vulnerability data to satisfy the automated audit and evidence requirements of SOC 2, GDPR, or HIPAA
Commercial tenure in high-velocity startups, with years spent scaling offensive security workflows, handling rapid client delivery timelines, and adapting to shifting priorities within fast-growth tech environments
Incident containment and threat training, including direct support of active incident response containment loops, or the design and execution of technical employee threat awareness initiatives
Benefits
Clear career path with mentorship and training opportunities
Reimbursement for the successful completion of approved training and certification courses relevant to your current role
Competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities
Early-stage company with significant room for career advancement
Flexibility to work from anywhere while collaborating with a global team
Application Process
Candidates must participate in live video interviews throughout the hiring process with camera on (non-negotiable)
Be prepared to verify identity during recruitment and onboarding
Employment is contingent upon successful completion of identity verification and background screening, where permitted by law
Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders to assess role fit, experience, and alignment with Workstreet’s operating principles
Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step
About the Company
Workstreet is a fast-growing startup that helps businesses scale securely by designing and implementing cutting-edge security and compliance programs. They specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP, empowering companies to meet regulatory requirements and enhance their cybersecurity posture from day one.
