Senior Penetration Testing Analyst 1

About this job

The Senior Penetration Testing Analyst 1 role at Sophos involves joining the company's Red Team to identify and exploit vulnerabilities within client environments, applying threat intelligence to uncover real-world adversary weaknesses. Sophos is a cybersecurity leader defending organizations globally with an AI-driven platform and expert-led services. In a normal day, you will act as the point of contact for testing readiness, coordinate schedules and communication between business and client teams, and escalate issues to management. You will focus on either application security or network security, using off-the-shelf and internally developed tools to execute manual testing for advanced attacks. Your day also involves producing professional security assessment reports, leading client-facing conference calls from project kick-off to close-out reviews, and performing proactive research to identify new threats, vulnerabilities, and exploits.

Responsibilities

• Coordinate activities, documentation, readiness schedules, and information between business, clients, and project teams.
• Act as the point of contact and communicate testing readiness status adequately to all participants.
• Use project management tools to monitor key tasks, responsible parties, timelines, and status.
• Conduct application security assessments or network penetration testing assessments using exploitation tools.
• Produce and deliver vulnerability and exploit information to clients in professional security assessment reports.
• Conduct client conference calls for kick-offs, high/critical findings notifications, and close-outs.
• Perform proactive research to identify and understand new threats, vulnerabilities, and exploits.

Requirements

• 5+ years of experience in Information Security
• Minimum of 2 years of experience with penetration testing
• Minimum of 2 years of experience with at least one of the following: Nmap, Metasploit, Kali Linux, Burp Suite
• Excellent client-facing and internal communication skills, both written and verbal
• Solid organizational skills including attention to detail and multitasking skills
• Experience with NMap Scanning and Linux
• Understanding of web application authentication methods, APIs, and networking appliances

Good to have

• Offensive certifications such as CEH, WAPT, GPEN, GWAPT, GAWN, OSCP
• Knowledge of NetSparker and AppScan; operating systems administration and internals
• Bachelor of Science degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical field
• Experience with various application attack vectors and OWASP Top 10
• Working knowledge of SQL and high-level languages

Who should apply

This role suits experienced cybersecurity professionals with a strong background in information security and penetration testing. Ideal candidates possess solid technical communication skills, analytical abilities, and experience in client-facing tasks. Applicants should have a background in either application security or network security testing, along with familiarity with standard penetration testing tools and methodologies. The posting specifies a requirement of 5+ years of information security experience, so freshers are not eligible.

Frequently asked questions