Penetration Tester

Stefanini brings together skilled penetration testers, security researchers, and red team operators with extensive experience across web, mobile, cloud, network, and enterprise environments.

Our approach combines technical excellence, proven methodologies, and close collaboration with clients to identify vulnerabilities, validate security controls, and enhance overall cyber resilience.

We're looking for someone who is genuinely passionate about cybersecurity and enjoys understanding how things work, and how they can be broken. The ideal candidate is curious, eager to learn, and motivated by finding security weaknesses before attackers do.

As part of Stefanini's Offensive Security team, you'll work on a variety of engagements, including web, mobile, internal infrastructure, and red team assessments. You'll collaborate with experienced security professionals, share knowledge, tackle new challenges, and help clients improve their security posture.

A problem-solving mindset, attention to detail, and the ability to work both independently and as part of a team are just as important as technical skills.

Key Responsibilities:

• Conduct penetration testing of web and mobile applications, IT infrastructure, networks, and enterprise environments to identify and validate security vulnerabilities.
• Perform security assessments using attacker techniques, tools, and methodologies to evaluate the effectiveness of existing security controls.
• Analyze applications, operating systems, databases, server technologies, and network infrastructure to identify weaknesses and potential attack vectors.
• Investigate identified vulnerabilities, determine root causes, and safely validate their potential impact on client environments.
• Document penetration testing results, technical findings, and remediation recommendations in clear, actionable reports for clients.
• Stay up to date with emerging cybersecurity threats, vulnerabilities, attack techniques, and industry best practices.
• Collaborate with the Offensive Security team and clients to share technical knowledge, support complex security assessments, and contribute to improving overall cyber resilience.

Education:

• Preferred: Bachelor's degree in computer science, Information Technology, Engineering or a related field.
• Preferred Certification: any relevant certification (examples: OSCP, OSCE, and similar) are considered a plus.

Language proficiency:

• Excellent English communication skills, both verbal and written, for professional communication and documentation.

Experience:

• 4+ years of cybersecurity experience in penetration testing of mobile and/or web applications, IT and network infrastructure, by safely utilizing the cyber attacker tools, tactics, and procedures.
• Advanced technical understanding of various web & mobile applications, frameworks, database technologies, server technology, operating systems, services, and network infrastructure, according to the scoping requirements.
• Advanced skills of identifying the root cause of cybersecurity issues, successfully exploit vulnerabilities, and document findings.
• Advanced experience with projects or issues of high complexity that require knowledge across multiple technical areas and business units.

Mandatory Technical skills:

• Ability to understand TCP/IP networking concepts.
• Advanced experience with programming languages (Python, Ruby, PHP, C#, .NET, etc.).

Soft skills:

• Excellent interpersonal and communication skills to share knowledge and to communicate effectively with different stakeholders (IT and business partners).

• Highly disciplined and motivated: a self-starter who can both work independently or as a member of a team.
• Ability to demonstrate a Can-Do, delivery-focused and solution-oriented approach (rather than problem-oriented).
• Analytical, flexible, practical - with good time management skills, strong attention to details and positive mindset.
• Ability to constantly be aware of new security issues, interested in reading technology articles and sharing knowledge.

Work conditions:

• Normal business hours.
• Working setup: hybrid.

Diversity & Inclusion

Here at the Stefanini Group, we value plurality and equity, regardless of race, sexual orientation, disability, age, ancestry, religion, gender, and nationality. We understand and encourage the importance of being you!

Education:

• Preferred: Bachelor's degree in computer science, Information Technology, Engineering or a related field.
• Preferred Certification: any relevant certification (examples: OSCP, OSCE, and similar) are considered a plus.

Language proficiency:

• Excellent English communication skills, both verbal and written, for professional communication and documentation.

Experience:

• 4+ years of cybersecurity experience in penetration testing of mobile and/or web applications, IT and network infrastructure, by safely utilizing the cyber attacker tools, tactics, and procedures.
• Advanced technical understanding of various web & mobile applications, frameworks, database technologies, server technology, operating systems, services, and network infrastructure, according to the scoping requirements.
• Advanced skills of identifying the root cause of cybersecurity issues, successfully exploit vulnerabilities, and document findings.
• Advanced experience with projects or issues of high complexity that require knowledge across multiple technical areas and business units.

Mandatory Technical skills:

• Ability to understand TCP/IP networking concepts.
• Advanced experience with programming languages (Python, Ruby, PHP, C#, .NET, etc.).

Soft skills:

• Excellent interpersonal and communication skills to share knowledge and to communicate effectively with different stakeholders (IT and business partners).

• Highly disciplined and motivated: a self-starter who can both work independently or as a member of a team.
• Ability to demonstrate a Can-Do, delivery-focused and solution-oriented approach (rather than problem-oriented).
• Analytical, flexible, practical - with good time management skills, strong attention to details and positive mindset.
• Ability to constantly be aware of new security issues, interested in reading technology articles and sharing knowledge.

Work conditions:

• Normal business hours.
• Working setup: hybrid.

Diversity & Inclusion

Here at the Stefanini Group, we value plurality and equity, regardless of race, sexual orientation, disability, age, ancestry, religion, gender, and nationality. We understand and encourage the importance of being you!