Penetration Tester

Mobile App Pentesting: 3+ years of hands-on experience testing Android and iOS applications in enterprise environments. Strong familiarity with OWASP MASVS/MASTG, including mapping test cases to MASVS levels and documenting coverage. Proficient in performing static/dynamic analysis using tools like MobSF, JADX, Hopper, Ghidra, ClassyShark, Frida, Objection, and Xposed to review APK/IPA files and manipulate runtime behavior. Experience with bypassing root/jailbreak detection, debugger checks, and anti-tampering mechanisms; skilled to identify/exploit mobile app vulnerabilities related to insecure data storage, communication, authentication/session management, platform usage, and code injection/runtime manipulation. Familiarity with mobile device management (MDM) and platform-specific security features such as Android Keystore, iOS Keychain, App Transport Security (ATS), and biometric authentication. Proficient in SSL/TLS interception and bypass techniques, including certificate pinning bypass using tools like mitmproxy, Charles Proxy, and custom scripts. Web & API Penetration Testing: 2+ years of hands-on experience with modern web apps and APIs. Deep understanding of OWASP Top 10, API Security Top 10, and SANS Top 25 vulnerabilities. Manual Testing & Exploitation: Proficiency in identifying/exploiting vulnerabilities in web apps and APIs using tools like Burp Suite Pro, Postman/Insomnia, and custom scripts; skilled in uncovering business logic flaws, access control issues, and chaining exploits to demonstrate real-world impact. Technical Proficiency: Strong scripting skills (Python, PowerShell, Bash, Ruby, Go). Solid grasp of HTTP/S, authentication protocols (OAuth, SAML, JWT), and network fundamentals (TCP/IP, DNS, firewalls, IDS/IPS). Tooling & Automation: Experience developing custom tools and scripts to automate testing workflows. Familiarity with tools such as Nmap, Metasploit, and Kali Linux. Show more Show less