Junior Pentester

About this job

Thoropass is transforming the security compliance and audit industry by combining compliance automation software with a tech-enabled audit firm and penetration testing services. The company helps thousands of customers ensure compliance is never a blocker to innovation through AI-powered solutions. As a Junior Penetration Tester at Thoropass, you will join the security team to deliver hands-on penetration tests for customers across web applications, APIs, mobile platforms, cloud environments, LLMs, and networks. On a normal day, you will work alongside senior testers to perform vulnerability assessments, utilize AI-assisted tools for workflows like reconnaissance and triage, validate results manually, and document security findings clearly with actionable remediation recommendations. You will also spend time learning, refining your craft, improving internal checklists and templates, and participating in mentorship and guidance sessions to grow your offensive security career.

Responsibilities

• Perform web application, API, mobile, LLMs, cloud and network penetration tests using AI tools and manual techniques.
• Utilize AI-assisted tools for reconnaissance, payload generation, and initial triage while validating results manually.
• Document findings clearly with reproduction steps, evidence, risk ratings, and remediation recommendations.
• Help improve internal templates, checklists, playbooks, and documentation based on engagement experience.
• Assist senior testers with scoping calls and pre-engagement preparation when required.

Requirements

• 1 to 2 years of experience in penetration testing, vulnerability assessment, or a closely related offensive security role.
• At least 1 certification from the following: BSCP or OSCP.
• Foundational understanding of web application security concepts including OWASP Top 10, auth flaws, and injection vulnerabilities.
• Willingness to use AI tools in workflows and basic understanding of validating AI-generated output.
• Demonstrated passion for security through self-study, lab work, CTF participation, bug bounty programs, or coursework.
• Fluency in English with professional verbal and written communication skills to convey technical topics.

Good to have

• Any published security research, responsible disclosures, blog posts, or conference talks.

Who should apply

This role is a great fit for individuals who are early in their offensive security career, think like an attacker, and are passionate about discovering vulnerabilities. It suits self-driven learners who spend time in labs, CTFs, or bug bounty platforms and are comfortable working with AI-assisted workflows. Candidates with early professional experience, internships, or relevant freelance and bug bounty backgrounds who meet the certification and technical criteria are encouraged to apply.

Frequently asked questions