Penetration Tester

You'll use Burp Suite daily for web application testing, intercepting and modifying requests, fuzzing parameters with Intruder, and identifying complex, chained vulnerabilities. You might even write a custom BApp or two.

You'll use Metasploit to search for, configure, and launch known exploits against vulnerable targets, and to perform post-exploitation techniques like pivoting and privilege escalation. You're comfortable customising payloads to evade basic defences.

You'll use Nmap for network discovery, service enumeration, and vulnerability scanning, often writing custom Nmap Scripting Engine (NSE) scripts. Nuclei will be your go-to for rapidly finding known CVEs and developing custom templates for our internal applications.

You'll use Hashcat to crack password hashes obtained during engagements, employing dictionary, mask, and rule-based attacks. You're adept at building custom wordlists and optimising performance.

This is where your findings live. You'll enter detailed vulnerability information, track remediation status, and generate client-ready reports using our customised templates. You're comfortable navigating the platform and ensuring data accuracy.

You'll create and update tickets for vulnerabilities in Jira, ensuring clear descriptions and reproduction steps for development teams. Confluence will be used for documenting internal TTPs, methodologies, and knowledge sharing within the team.

• Senior Penetration Testers (for technical guidance and peer review)
• Security Operations (Blue Team) (to share TTPs and improve detection)
• Development Teams (to explain findings and help with remediation)
• Project Managers (to coordinate testing schedules and scope)
• Product Owners (to explain business risk of vulnerabilities)

• Occasionally, you might interact with external auditors if they have questions about a test you conducted, but this is rare and usually handled by senior team members.

More and more of our infrastructure is moving to the cloud. While you have intermediate skills now, you'll need to become an expert in exploiting cloud-specific misconfigurations and services, as traditional network pentesting becomes less relevant for cloud-native applications.

Serverless Function Exploitation · Cloud IAM Role Chaining · Container Escape Techniques · Cloud Security Posture Management (CSPM) Bypass

• This week: Pick one cloud provider (AWS, Azure, or GCP) and commit to deeply understanding its security model.
• This month: Complete a cloud-specific penetration testing course or lab (e.g., Certified Cloud Security Engineer).
• Month 2: Practice exploiting common cloud misconfigurations in a dedicated lab environment.
• Month 3: Propose a cloud-focused penetration test for one of our internal cloud services.

Quick win: Set up a free tier cloud account and start exploring the security settings and potential misconfigurations of basic services like S3 buckets or EC2 instances.

The focus is shifting from just finding vulnerabilities to testing our overall defensive capabilities. This means you'll need to understand how to simulate realistic attacker behaviour and collaborate closely with our Blue Team to improve detection and response.

Red Team Operations Fundamentals · Blue Team Detection Techniques · Threat Intelligence Integration · Post-Exploitation Frameworks

• This week: Read up on the MITRE ATT&CK framework and how it's used for adversary emulation.
• This month: Participate in a 'purple team' exercise, even if it's just a small internal one, to understand the collaboration.
• Month 2: Take an online course or lab focusing on Red Team tactics and techniques.
• Month 3: Propose a small-scale adversary simulation exercise for a specific internal system.

Quick win: Start mapping your current penetration testing findings to specific MITRE ATT&CK techniques to better communicate their impact to the Blue Team.