Penetration Tester

Can you imagine taking part in the transformation of leading national and international organizations?

At Deloitte, we are committed to making an impact on society, our clients, and our people.

In this role you will be part of the Global Cyber Services team, delivering penetration testing services that combine tools, methodologies and manual analysis to evaluate and strengthen the security of applications, networks and environments for clients and the firm.

Key responsibilities

• Execute penetration testing engagements across multiple attack surfaces: web applications, APIs, networks, mobile, thick clients and AI/LLM-based systems.
• Design and perform automated and manual tests, producing clear, actionable, and prioritized findings for technical and non-technical audiences.
• Use and adapt testing platforms and tools (e.g., Kali Linux, Burp Suite, Nmap, Metasploit, sqlmap, AMASS, Postman/Swagger).
• Apply AI and LLM techniques (prompt engineering, agents, emerging frameworks) to accelerate reconnaissance and to generate or refine testing scripts.
• Develop, maintain, and validate AI-driven agents and tools to automate recurring testing tasks, reducing false positives and improving accuracy.
• Evaluate and integrate emerging AI-assisted offensive security tools into the team’s methodologies and playbooks.
• Create and maintain technical documentation, methodologies, and standard operating procedures (SOPs).
• Communicate service capabilities and test results effectively to clients and global stakeholders.

What we’re looking for

• 4+ years of experience in penetration testing, security assessment, or similar roles.
• Hands-on experience with pentesting platforms and tools (Kali or another dedicated OS; Burp Professional, Nmap, Metasploit, sqlmap, AMASS, etc.).
• Knowledge of OWASP Top 10 and familiarity with API, thick client, and LLM/AI attack surfaces.
• Experience with AI models and frameworks (e.g., OpenAI, Anthropic) and tooling (Obsidian, Ollama) is a plus.
• Scripting skills and working knowledge of at least one programming language and framework.
• Ability to work with diverse stakeholders and manage concurrent initiatives with good judgement and prioritization.
• Strong written and verbal communication skills in English; Spanish native or fluent is a plus.

Preferred

• Certifications: OSCP, CEH, GIAC (GPEN, GSEC, GWAB, GMOB, GCPN) or equivalent.
• Familiarity with MITRE ATT&CK, SAST/DAST, cloud testing, and reverse engineering.
• Experience in agentic development and deploying/hosting AI tools (containers, servers, APIs).
• Experience working in distributed teams and global projects.

Limited immigration sponsorship may be available in some locations.

What is it like to work at Deloitte?

High-impact projects offering long-term growth and continuous learning opportunities.

Hybrid and flexible working model, with flexible hours and a healthy balance between remote work and collaboration in our offices or at client sites.

A positive and collaborative work environment, with team-building activities, cultural and sports events throughout the year.

Holistic wellbeing, supported by our physical, mental, and financial health programs, including on-site medical services.

Social impact, with access to a wide range of national and international volunteering initiatives and pro bono projects where you can contribute your time and talent.

A strong feedback culture and continuous learning, within an inclusive environment that promotes equal opportunities and personalized development plans. You may even see yourself at Deloitte University in Paris.

Exclusive benefits, including a comprehensive benefits portfolio and a flexible compensation plan.

Next steps:

If what you have read resonates with you, here is what comes next:

• Apply to the position by clicking “Apply now” and completing your profile.
• If your experience matches the role, our Talent team will contact you to get to know you better.

Start your journey with Deloitte. We will guide you through each stage of the process until your onboarding.