Penetration Testing Analyst 3

About this job

Sophos is a global cybersecurity leader that protects numerous organizations using advanced AI-driven platforms, expert services, and real-time threat intelligence. As a Penetration Testing Analyst 3 on the Red Team, you will help organizations identify and exploit vulnerabilities by simulating real-world cyberattacks. A normal day in this role involves acting as the primary point of contact for test readiness, coordinating timelines between clients and project teams, escalating issues to management, and performing hands-on security assessments. You will focus either on application security like web, mobile, and API testing, or network security including vulnerability assessments and internal or external penetration tests. You will also use standard and custom tools for manual testing, produce professional security reports, lead client-facing conference calls from kick-off to close-out reviews, and proactively research emerging threats and exploits to help clients improve their defenses.

Responsibilities

• Coordinate activities, schedules, and information between business units, clients, and project teams.
• Monitor key tasks, timelines, and status using project management tools while escalating issues as needed.
• Conduct application security assessments or network penetration testing using manual testing methods and exploitation tools.
• Produce and deliver professional security assessment reports detailing vulnerabilities and exploits to clients.
• Lead client conference calls covering test readiness, project kick-offs, critical findings, and close-out reviews.
• Perform proactive research to identify and understand new threats, vulnerabilities, and exploits.

Requirements

• 3+ years of experience in Information Security.
• Minimum of 3 years of experience with penetration testing.
• Minimum of 3 years of experience with at least one tool such as Nmap, Metasploit, Kali Linux, or Burp Suite.
• Excellent client-facing and internal communication skills in both written and verbal formats.
• Solid organizational skills with strong attention to detail and multitasking capabilities.
• Ability to learn quickly, work as a self-directed contributor, and thrive in a high-energy team environment.

Good to have

• Experience with NMap scanning, Linux, and network validation tools.
• Understanding of web application authentication methods, networking, and security appliances.
• Offensive security certifications such as CEH, WAPT, GPEN, GWAPT, GAWN, or OSCP.
• Knowledge of operating systems administration and internals for Microsoft Windows and Linux.
• Familiarity with TCP/IP networking, OWASP Top 10, and various application attack vectors.

Who should apply

This role suits experienced cybersecurity professionals with a solid background in penetration testing and client communication. Candidates should have a proactive approach to researching threats and the ability to manage testing readiness tasks independently or within a team. If you bring strong technical communication skills and practical experience in either network or application security, you are encouraged to apply even if you do not check every single box.

Frequently asked questions