Job description for Penetration Tester at Abishar Technologies
Job Description
- Run regular vulnerability scans using tools (e.g., Tenable Nessus, Qualys, Rapid7).
- Assist in analyzing scan results, identifying false positives, and validating findings.
- Assist in performing penetration tests on web applications, mobile apps, networks, and infrastructure.
- Conduct reconnaissance, scanning, and enumeration activities to gather information about targets.
- Support vulnerability exploitation and privilege escalation testing under senior guidance.
- Use penetration testing tools such as Burp Suite, Nmap, Metasploit, Kali Linux, Hydra, Wireshark, etc.
- Help develop proof-of-concept (PoC) exploits to demonstrate security weaknesses.
- Document vulnerabilities with detailed remediation guidance for developers/IT teams.
- Contribute to red team and purple team exercises.
Primary Qualifications
- Education: Bachelor's degree in IT or a related field.
- Web Application Security: Deep understanding of the OWASP Top 10 vulnerabilities (SQLi, XSS, SSRF, IDOR, etc.), API testing (REST/GraphQL), and the ability to chain vulnerabilities to demonstrate maximum impact.
- Network & Infrastructure: Proficiency in exploiting internal and external network vulnerabilities. Strong knowledge of TCP/IP, the OSI model, and common network protocols.
- Solid understanding of networking and security protocols, infrastructure, hardware, web applications, and databases.
- Strong knowledge of current hacking techniques, vulnerability disclosures, data breach incidents, and security analysis techniques.
- Knowledge and hands-on experience with penetration testing tools such as Burp Suite, Kali Linux, Nmap, PowerShell, and Bash scripting.
- Scripting & Development: Ability to write or modify custom scripts and exploits. Proficiency in at least one scripting language (Python, Bash, PowerShell, or Go).
- Knowledge and hands-on experience in security hardening across multiple environments: operating systems, network devices, and applications.
- Prerequisite knowledge: Cyber security.
- Minimum 2-3 years of experience in pentesting for web or infrastructure.
- Certified in one of: PenTest+ or eJPT (preferred); OSCP is a plus.
