Penetration tester (Ethical Hacker) | Ukraine

We are looking for a Penetration Tester (Ethical Hacker) with hands-on experience in web application and API security testing, a strong technical mindset, and an interest in emerging AI security challenges.

What we expect:

• Commercial experience in web application and API penetration testing and vulnerability assessment.
• Solid understanding of common web vulnerabilities (OWASP Top 10, OWASP API Security Top 10) and the ability to identify and exploit them manually, beyond scanner output.
• Working knowledge of penetration testing methodologies, such as OWASP WSTG.
• Confident use of Burp Suite and other common web security testing tools.
• Basic understanding of LLM-based applications and their typical attack surfaces, including prompt injection, insecure output handling, and excessive agency.
• Ability to assess the technical risks and business impact of identified vulnerabilities.
• Good spoken English and strong reading comprehension for client communication and working with technical documentation.
• Strong technical writing skills, including the ability to prepare clear, structured reports, instructions, templates, and guidelines.
• Commitment to continuous learning and professional development.
• Relevant professional certifications, such as BSCP, eWPTX, CPTS, COAE, CWEE, OSWE, OSAI, or equivalent, or willingness to pursue them.

Nice to have:

• Hands-on experience testing LLM-based applications, AI agents, or RAG systems, including familiarity with OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Experience using AI coding agents such as Claude Code, Codex CLI, Cursor, or similar tools in security-related work.
• Experience building AI-assisted testing solutions, including custom prompts and skills, MCP servers, tool integrations, and agentic workflows.
• Experience evaluating security tools and AI-driven solutions against real-world targets.
• Scripting or programming skills in Python, JavaScript/TypeScript, or Bash.
• Experience with source code security reviews.
• Hands-on experience in mobile application security testing.
• Experience with cloud security testing across Azure, AWS, or GCP.
• Knowledge of thick client and network penetration testing or reverse engineering.
• Involvement in security research, Hack The Box, CVE discoveries, bug bounty programs, or CTF competitions.