Senior Penetration Testing Analyst 2
About this job
Sophos is a global cybersecurity leader that defends hundreds of thousands of organizations using an advanced AI-driven platform and expert-led services. As a Senior Penetration Testing Analyst 2, you will join the Sophos Red Team to identify and exploit vulnerabilities within client environments, applying threat intelligence to uncover real-world adversary weaknesses. Your work will focus on application security, such as web, mobile, and API testing, or network security, including vulnerability assessments and internal and external penetration tests. A normal day involves performing manual testing using specialized tools, producing professional security assessment reports, researching emerging threats, and leading client-facing conference calls from project kick-off to close-out reviews where you explain remediation recommendations.
Responsibilities
- Conduct application security assessments including web, mobile, and API testing or network penetration testing.
- Perform manual exploitation testing using off-the-shelf or internally developed tools.
- Produce and deliver professional security assessment reports containing vulnerability and exploit details.
- Lead client conference calls covering project kick-offs, critical finding notifications, and close-out reviews.
- Conduct proactive research to identify and understand new threats, vulnerabilities, and exploits.
- Work effectively as a self-directed individual contributor and collaborate as a team member.
Requirements
- Typically requires 7+ years of related experience with a Bachelor's degree, 5+ years with a Master's degree, 3+ years with a PhD, or equivalent experience.
- Minimum of 4 years of experience specifically in penetration testing.
- Minimum of 4 years of experience using at least one tool among Nmap, Metasploit, Kali Linux, or Burp Suite.
- Possession of offensive security certifications such as CEH, WAPT, GPEN, GWAPT, GAWN, or OSCP.
- Strong technical communication skills for written reports and verbal client interactions.
- Sound analytical, problem-solving abilities, and a proactive approach to research.
Good to have
- Knowledge of NetSparker and AppScan, and operating systems administration for Windows or Linux.
- Experience with application attack vectors, security test processes, and common vulnerabilities like OWASP Top 10.
- Technical understanding of TCP/IP networking.
- Bachelor of Science degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical field.
- Working knowledge of SQL and high-level languages.
Who should apply
This role suits experienced cybersecurity professionals with a solid background in penetration testing and relevant offensive security certifications. Candidates must have extensive hands-on experience with tools like Kali Linux, Burp Suite, or Metasploit, alongside strong client-facing communication skills. This position is not open to freshers as it requires multiple years of professional security experience. Applicants must have legal authorization to work in the posting jurisdiction without employer sponsorship.
Frequently asked questions
What is the primary focus of the Senior Penetration Testing Analyst 2 role at Sophos?
The role focuses on application security or network security testing, identifying vulnerabilities, conducting manual exploitation, and delivering security assessment reports to clients.
What tools and certifications are required for the Senior Penetration Testing Analyst 2 position?
Candidates need at least 4 years of experience with tools like Nmap, Metasploit, Kali Linux, or Burp Suite, and offensive certifications such as CEH, WAPT, GPEN, GWAPT, GAWN, or OSCP.
Does Sophos require employer sponsorship for the Senior Penetration Testing Analyst 2 role?
Applicants must have legal authorization to work in the jurisdiction where the position is posted without requiring employer sponsorship.
What client-facing duties are involved in the Senior Penetration Testing Analyst 2 job?
Analysts lead client conference calls, including project kick-offs, notifications of critical findings during testing, and close-out reviews of findings and remediation recommendations.
Rojgar Point lists this job for information. Always apply on the official company page and never pay anyone for a job.