Penetration Tester

Project overview

My client, a software company's AppSec team is responsible for securing a portfolio of around 400 products and needs external support to test them. We’re looking for mid-level freelance pentesters to work through the portfolio remotely in a structured, prioritised way.

Responsibilities

• Penetration testing of web applications: OWASP Top 10, authentication and session management, access control, business logic and API security (REST/SOAP)
• Testing desktop applications (thick clients): local storage, traffic interception, DLL hijacking, privilege escalation, back-end communication
• Black box and grey box testing, depending on the product
• Manual validation of findings, not just scanner output
• CVSS rating and clear reports with remediation guidance
• Presenting findings to product and dev teams and retesting fixes

Requirements

• Proven hands-on application pentesting experience at mid level
• Certification: OSCP, PNPT, BSCP, eCPPT or similar
• Burp Suite and common tooling (Nmap, sqlmap, ffuf, Postman)
• Solid knowledge of HTTP, web technologies, OAuth, SAML, JWT
• Thick client / desktop testing experience
• Fluent English

Nice to have

Framework

• Mobile app pentesting (Android/iOS, MobSF, Frida)
• Scripting (Python, Bash, PowerShell)
• 100% remote, Europe-based, using your own laptop

Project details

• Start: ASAP
• Remote: remote
• Location: iasi, Romania, RO
• Languages: English