Senior Penetration Tester

Job Description: Senior Penetration Tester

Job Title:

Senior Penetration Tester

Department:

Cybersecurity / Information Security

Experience:

5+ years of relevant experience (preferred)

Job Summary

We are seeking an experienced Senior Penetration Tester to conduct comprehensive security assessments across web applications, internal and external infrastructure, Active Directory environments, and client-server applications. The ideal candidate should have strong expertise in application security testing, source code analysis, SAST/DAST, network penetration testing, OSINT, and identifying and exploiting security vulnerabilities.

The candidate will be responsible for assessing security risks, validating vulnerabilities, recommending remediation measures, and preparing detailed technical reports to strengthen the organization's overall security posture.

Key Responsibilities

• Conduct penetration testing of web applications, APIs, and other application environments.

• Perform application security assessments using SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools.

• Conduct manual source code reviews to identify security flaws, insecure coding practices, and potential vulnerabilities.

• Perform internal and external network penetration testing to identify vulnerabilities and assess potential attack paths.

• Conduct Active Directory security assessments

  , including enumeration, privilege escalation, misconfiguration analysis, and attack path identification.

• Perform penetration testing of thick-client and thin-client applications, including client-server communication and authentication mechanisms.

• Conduct Open-Source Intelligence (OSINT) activities to identify publicly exposed assets, information leakage, and potential attack surfaces.

• Identify, validate, exploit, and document security vulnerabilities while following authorized testing procedures.

• Assess authentication, authorization, session management, access controls, and common application security weaknesses.

• Use industry-standard penetration testing tools and methodologies to perform security assessments.

• Prepare detailed penetration testing reports, including findings, risk ratings, proof of concept, business impact, and remediation recommendations.

• Work closely with development, infrastructure, and security teams to validate findings and support vulnerability remediation.

• Perform retesting to verify that identified vulnerabilities have been appropriately resolved.

• Follow recognized security standards and methodologies, including OWASP, PTES, and relevant MITRE ATT&CK techniques.

Required Technical Skills

• Application Security:

  Web application and API penetration testing, OWASP Top 10, authentication and authorization testing.

• SAST/DAST:

  Experience with security testing tools and interpretation of scan results.

• Source Code Analysis:

  Ability to review source code and identify security vulnerabilities.

• Active Directory:

  AD enumeration, privilege escalation, Kerberos-related attacks, misconfiguration analysis, and lateral movement techniques.

• Internal & External Penetration Testing:

  Network enumeration, vulnerability assessment, exploitation, and attack path analysis.

• Thick & Thin Client Testing:

  Experience assessing client-server applications, business logic, and communication protocols.

• OSINT:

  Publicly exposed asset discovery, reconnaissance, and information gathering.

• Reporting:

  Strong technical documentation, risk assessment, and remediation guidance skills.

Preferred Tools & Technologies

Experience with relevant tools such as:

• Application Security:

  Burp Suite Professional, OWASP ZAP, Postman.

• SAST/DAST:

  SonarQube, Checkmarx, Fortify, Veracode, or equivalent tools.

• Network Penetration Testing:

  Nmap, Nessus, Metasploit.

• Active Directory:

  BloodHound, Impacket, NetExec, Mimikatz.

• Source Code Analysis:

  Semgrep, CodeQL, and manual code review techniques.

• OSINT:

  Maltego, theHarvester, Amass, and other reconnaissance tools.

• Operating Systems:

  Kali Linux, Windows, and Linux server environments.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.

• Minimum 5 years of hands-on penetration testing or offensive security experience preferred.

• Demonstrated experience in application security, infrastructure penetration testing, and Active Directory assessments.

• Strong understanding of common vulnerabilities, exploitation techniques, and security testing methodologies.

• Relevant certifications such as CRTP, CPTS, OSCP, PNPT, OSWE, GWAPT, or equivalent are an advantage.

• Excellent analytical, troubleshooting, communication, and report-writing skills.

• Ability to work independently and conduct security assessments within defined scopes and rules of engagement.

Expected Deliverables

• Comprehensive penetration testing reports.

• Documented and validated security vulnerabilities with evidence.

• Risk-based remediation recommendations.

• Retesting and remediation verification reports.

• Clear communication of technical risks and business impact.

Ideal Candidate:

A hands-on senior penetration tester with strong expertise in application security, SAST/DAST, source code analysis, Active Directory, internal and external infrastructure, thick/thin client testing, and OSINT.

Location:

Doha, Qatar