About This Role
This role focuses on identifying and validating security vulnerabilities through hands-on laboratory testing, evaluating device security configurations and controls, and providing actionable, risk-based remediation recommendations to clients. The Penetration Tester will conduct and support security assessments of network-connected devices and technologies, with an emphasis on Intelligent Transportation Systems (ITS) and transportation infrastructure.
Responsibilities
- Conduct penetration tests and security assessments of network-connected devices, embedded systems, web-based management interfaces, APIs, and supporting technologies
- Perform manual and automated testing to identify, analyze, and validate vulnerabilities, including weaknesses in authentication, authorization, session management, input validation, network services, and access controls
- Evaluate device configurations and security controls against industry best practices and applicable security standards
- Use security tools, scripting languages, and established testing methodologies to perform thorough and repeatable assessments
- Document testing activities, technical evidence, confirmed vulnerabilities, associated risks, and actionable remediation recommendations in professional reports
- Clearly communicate technical findings and risk-based recommendations to technical and non-technical stakeholders
- Collaborate with team members to investigate complex vulnerabilities and improve testing procedures, methodologies, and technical capabilities
- Research emerging vulnerabilities, attack techniques, security risks, and advances in penetration-testing tools and methodologies relevant to assessed technologies
- Spend 60% of time on penetration testing
- Spend 10% of time on project coordination and tracking
- Spend 10% of time on reporting quality assurance
- Spend 10% of time as a cybersecurity subject matter expert
- Spend 10% of time on personal growth and development
Requirements
- Bachelor’s degree in Cybersecurity, Information Systems, or a related field preferred; equivalent work experience accepted
- 5+ years of relevant cybersecurity experience, including hands-on penetration testing experience
- Relevant security certifications such as OSCP, GPEN, PNPT, or equivalent practical experience
- Experience with tools such as Burp Suite Professional, Ghostwriter, n8n
- Experience with Scripting: Perl, Python, JavaScript, bash
- Demonstrable Linux Proficiency: CentOS, Ubuntu, Debian, RedHat
- Strong hands-on proficiency with Burp Suite, including Proxy, Repeater, Intruder, and other tools used for manual web application and API security testing
- Demonstrated ability to analyze HTTP/HTTPS requests and responses, manipulate application traffic, and identify vulnerabilities in authentication, session management, and access controls