Position: Penetration tester
Category: Security
English level: upper
Years of experience: 4


General information:
Penetration testing WEB applications with black-\grey-\white- box approach. 4+ years of experience
Manual, semi-automated checks with BurpSuite for access controls, injections, business logic abuses, OWASP10, etc. Writing scripts for multi-step exploitation with Python\Bash\BurpSuite extensions.

Source code security checks for known vulnerable patterns and dangerous functions. Detecting insecure application business logic (WhiteBox).

Penetration testing iOS\Android applications (rooting, jailbreaking, bypass root\jailbreak detection, frida tools, adb, MobSF, GrapeFruit, etc.; use of MSVS, OWASP MSTG guidelines)

Information Gathering and Reconnaissance
Vulnerability Assessment of External Networks
Vulnerability Assessment of Web Applications, iOS\Android applications.

Pivoting, Exploitation, Privilege Escalation, Post-Exploitation, and persistence with Metasploit.

Advanced Reporting skills: 

impact and difficulty definition, describing the issue and providing recommendations for the root cause. Evaluate severity according to the risk matrix and CVSS3.0.


Technical skills:

Methodologies and cheatsheets - OWASP WSTG, OWASP MSTG, MSVS, ASVS, hacktricks, portswigger.
OS - WEB, iOS, Android, Windows, *-nix
Cloud: AWS infrastructure configuration security assessment.
Tools: Burp Suite, offensive security(Kali linux\parrot OS) toolset of nmap, whatweb, wpscan, gobuster, dirb sqlmap, Metasploit, hashcat, Nessus, OpenVAS, etc. ; ScoutSuite reports, Pacu.

Grapefruit, adb, frida, frida-tools, MobSF, Android Studio, jadx (jd-gui), etc.

Soft and Management skills:
Process excellence
Process optimization researching.
Communication with clients and managers (Q&A)
Providing project status updates
taking a Project lead role responsibilities - team\self coordination during a project, time estimations.
I am open to discussing only penetration testing opportunities. 

A brilliant opportunity for me is a penetration testing position (or Security Engineer with similar requirements), which includes the scope of work as Web, API, and mobile applications. The job is in Pentest-as-a-Service.
The team that has many security-related learning benefits and knowledge sharing on leading trends such as cloud security, mobile application pen-tests, and interesting and complex real-life cases in Web applications, but not limited to them.