We are seeking a skilled and driven penetration tester with a hacker mindset to proactively simulate real-world attacks to identify, assess, and exploit security vulnerabilities.
You’ll be part of a fast-paced security team, expected to think like an adversary while maintaining ethical standards and compliance.
You must be capable of both automated and manual testing, custom script writing, and producing detailed yet understandable reports.
Key Responsibilities
Conduct black-box, gray-box, and white-box penetration tests on: Web apps, Mobile apps, APIs.
Perform social engineering and phishing simulation campaigns.
Develop and execute custom exploits where necessary.
Document proof-of-concept exploits and provide risk-ranked findings.
Conduct red team exercises simulating advanced persistent threats (APT).
Analyze security findings from Hacker One and recreate vulnerabilities.
Collaborate with developers, Appsec Team, DevOps, and product teams to provide remediation guidance.
Stay current on CVEs, exploits, hacker tools, and threat actor techniques (TTPs).
Weekly updates and debriefs with stakeholders.
Manual Application and Api Penetration testing based on Owasp top 10 (Mobile,Web,Api).
Minimum Requirements
Bachelor's Degree with 5 years of experience.
Proven experience in offensive security or ethical hacking.
Demonstrated history with Bug Bounty programs or CTF competitions.
Deep understanding of web technologies, cloud platforms, and modern infrastructure.
Ability to write and explain exploits or security PoCs clearly.
Strong report writing and communication skills.
Tools and Platforms (it’s expected to have knowledge of how to use at least one of each of the listed tools):
You can either reveal the employer's email + apply from your own inbox (recommended - unlimited, no cap, familiar), or let Openings send the email on your behalf with your CV attached (handy on mobile; capped at 2/day).
Who's applying?
Takes under a minute. We email a one-click magic link - clicking it signs you up (no password), creates your free Openings account, and brings you right back here to send.
Use a real email you can open now. No link, no send. Typos burn your daily quota.
Check your email
Magic link sent to . Click it and we'll bring you right back with your compose ready. No password needed - the click also creates your free Openings account.
The employer receives your email directly. Tap the button to copy the address - status updates come from the employer.
How to apply
Interested and qualified candidates should send their CVs in PDF to: c***@gvapartners.comand copyt***@gvapartners.com using the job title as the subject of the mail.
They see your structured profile as it stands at the moment you apply, plus your CV if you have one attached. That snapshot is frozen - if you edit your profile next week, this application still shows what you sent today. Your salary expectation is never sent unless you choose to include it.
Yes. The match figure is for you, not for them - GVA Partners does not see it. The apply button works the same regardless of your match percentage.
Because boards rewrite titles when they republish. All copies of this vacancy are the same job at the same employer with the same closing date. We show the employer's own wording and list the rest above so you know you have already seen it.
It appears in your application tracker straight away. Because this application is handled here rather than on an external site, you will see the status change as GVA Partners moves it - viewed, shortlisted, interviewing or declined. Roles that redirect to an employer's own site cannot be tracked that way, and we say so on those listings.
This employer has not yet been checked against the corporate register.
Regardless of any of that, no employer on this platform may ask you for money at any stage. If this one does, report it and tell us what they asked for.