Primary responsibilities:
Conduct external reconnaissance and penetration testing of 10 internet-facing IP addresses/services, including VPN and remote access; perform authenticated and unauthenticated testing of up to three applications; assess authentication, authorization, sessions, input handling, and business logic; validate vulnerabilities and collect reproducible evidence; support infrastructure scanning and findings documentation.
Reporting responsibilities:
Prepare external network and web application findings, technical and executive report content, supporting evidence, remediation guidance, and control-mapping inputs; peer-review relevant findings.
Required technical knowledge:
OWASP Web Security Testing Guide and Top 10; network/service enumeration; VPN security; authenticated application testing; access-control and session weaknesses; manual exploit validation and secure evidence handling.
Recommended experience:
4+ years in external network and web application penetration testing, including authenticated testing and production-safe validation.
Recommended certifications:
OSCP, OSWE, GWAPT, or equivalent application/network testing certification.
Key deliverables:
External network and web application technical/executive report; validated findings and evidence; contributions to the consolidated findings register and final report.
