Responsibilities

- Independently perform penetration tests across web applications, APIs, thick client, mainframe, mobile following established methodologies (OWASP Testing Guide, PTES, NIST SP 800-115).

- Identify, exploit, and document vulnerabilities, providing clear evidence of impact (proof-of-concept, not just tool output) for each finding.

- Write clear, client-ready findings reports that translate technical vulnerabilities into business risk, including root cause analysis and actionable remediation guidance.

- Participate in client-facing calls, including scoping discussions, kickoff meetings, and findings walkthroughs/readouts.

- Validate automated scanner output to eliminate false positives and confirm real-world exploitability before reporting.

- Collaborate with engagement leads on scoping, methodology selection, and complex or ambiguous findings.

- Stay current on emerging attack techniques, CVEs, and tooling relevant to the engagements you support.

- Mentor junior testers on technique, tooling, and report writing as the team scales.

- Adhere strictly to engagement rules of engagement (RoE), scope boundaries, and legal/ethical testing guidelines on every client engagement.

- Contribute to internal methodology development, tooling improvements, and knowledge-sharing within the practice.

Requirements





- 4+ years of hands-on penetration testing or offensive security experience (internal team or consulting).

- Demonstrated experience testing at least two of the following: web applications, APIs, thick client, mainframe, mobile applications.

- Strong working knowledge of the OWASP Top 10, common network attack vectors, and Active Directory attack paths.

- Proficiency with core tooling: Burp Suite (or equivalent), Nmap, Metasploit,

- Demonstrated ability to write clear, qualified findings reports independently — this role requires strong written communication, not just technical execution.

- Comfortable presenting technical findings to both technical and non-technical client stakeholders.

- Industry certifications such as OSCP, GPEN, GWAPT, or equivalent hands-on-proctored certifications (preferred over purely multiple-choice credentials for this role).

- Prior consulting/client-facing experience, including scoping conversations and managing client expectations under time-boxed engagements.

- Experience contributing to or building internal tooling/scripts to improve testing efficiency.

- Active participation in the security community (CTFs, bug bounty, conference talks, published research) as a signal of ongoing skill development

📌 Penetration Tester (Bengaluru)
🏢 Promaynov Advisory Services
📍 Bengaluru