Penetration Tester

Penetration Tester – MSSP, New York Role at a glance Job title: Penetration Tester Company: Growing Managed Security Services Provider (MSSP), name withheld Location: New York, NY (Manhattan office) Work pattern: Hybrid, 2 days on-site, with occasional client site visits Employment type: Full-time, permanent Experience: 4+ years of hands-on penetration testing Salary: $150,000 – $180,000 base + bonus (DOE) Reports to: Head of Offensive Security About the company Our client is an established Managed Security Services Provider headquartered in New York. They protect mid-market and enterprise organisations across financial services, healthcare, legal and technology. Their services span 24/7 SOC monitoring, MDR, vulnerability management and a fast-growing offensive security practice. Continued client demand means they are expanding the penetration testing team. The role You will deliver hands-on penetration tests across a varied client base, from scoping through to the final report. Each engagement is different, covering networks, web applications, cloud and Active Directory. You will work directly with client stakeholders and turn technical findings into clear, prioritised remediation advice. You will also help shape the methodology and tooling of a growing team. Key responsibilities Perform internal and external network penetration tests, including Active Directory attack paths Test web applications and APIs against OWASP Top 10 and beyond, with manual testing, not just scanning Assess cloud environments (AWS, Azure, GCP) for misconfiguration and privilege escalation Carry out wireless, social engineering and phishing assessments as engagements require Scope engagements with clients and the account team, and agree rules of engagement Write clear technical and executive reports with risk ratings and practical remediation steps Present findings on client debrief calls and support retesting Build scripts and tooling to automate repeatable testing tasks Keep up with new vulnerabilities and attack techniques, and share knowledge with the team Required experience and skills 3+ years of hands-on penetration testing, ideally in a consultancy or MSSP setting Strong grasp of network and web application testing methods (OWASP, PTES, NIST SP 800-115) Practical Active Directory exploitation experience (Kerberoasting, relay attacks, privilege escalation) Confident with Burp Suite Pro, Nmap, Metasploit, BloodHound, Impacket and similar tools Scripting in Python, Bash or PowerShell Solid knowledge of Windows and Linux internals, networking, and common protocols Excellent written English, with a strong report-writing portfolio Comfortable working directly with clients at technical and executive level Authorised to work in the US without sponsorship Nice to have Certifications such as OSCP, PNPT, CRTO, GPEN, GWAPT or OSWE (OSCP strongly preferred) Cloud penetration testing experience, plus container and Kubernetes security Mobile application testing (iOS and Android) Red team or adversary simulation exposure, including C2 frameworks Experience with compliance-driven testing (PCI DSS, SOC 2, HIPAA, NYDFS 500) CVEs, published research, bug bounty or CTF achievements What's on offer Base salary of $150,000 – $180,000 plus annual performance bonus Fully funded certifications and training budget, plus dedicated lab time Medical, dental and vision insurance, and a 401(k) with company match Generous PTO plus paid holidays Clear progression to Senior Penetration Tester and Red Team roles A varied client base, so no two engagements are the same