Penetration Tester

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, inclusive culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

The Penetration Tester conducts authorized security assessments of applications, APIs, and network infrastructure to identify vulnerabilities and security weaknesses. Working closely with development, infrastructure, and security teams, the Penetration Tester leverages technical expertise, creativity, and an attacker mindset to identify and exploit weaknesses in internally developed and third-party systems.

The ideal candidate is responsible for performing security assessments, documenting findings, validating remediation efforts, and providing actionable recommendations based on industry best practices. The ideal candidate has experience with application and network penetration testing, a strong understanding of secure development principles, and familiarity with modern security testing methodologies including OWASP Top 10, SANS Top 25, and API security testing.

Responsibilities

• Perform web application, API, and network security assessments.

• Identify, exploit, and validate security vulnerabilities in applications and infrastructure.

• Create test cases, document findings, and track remediation activities in Azure DevOps.

• Provide risk-based security recommendations and guidance to stakeholders.

• Validate remediation efforts and conduct retesting of previously identified vulnerabilities.

• Research emerging threats, attack techniques, and industry security trends.

• Assist in developing and automating penetration testing methodologies and security processes.

• Participate in the creation of technical and executive-level assessment reports.

• Utilize AI-assisted tools and techniques where appropriate to improve testing efficiency and coverage.

• Perform other duties as assigned.

Qualifications

EDUCATION

Bachelor’s degree in computer science, Cybersecurity, Information Technology, or equivalent experience.

CERTIFICATIONS (preferred)

• GPEN (GIAC Penetration Tester)

• CEH (Certified Ethical Hacker)

• Security+

• CISSP

TECHNICAL SKILLS

Required

• Experience performing web application and network penetration testing.

• Proficiency with Burp Suite Professional.

• Understanding of OWASP Top 10, SANS Top 25, and common attack methodologies.

• Ability to read, understand, and audit source code during source code-assisted penetration testing.

• Strong understanding of authentication, authorization, session management, and common application security vulnerabilities.

• Experience creating clear and actionable technical documentation and reports.

• Experience With:

  • Programming Languages: C#, Java, JavaScript, Python, or similar.

  • Scripting/Automation: Python, PowerShell, Bash, or equivalent.

  • API Security Testing (REST, GraphQL, SOAP).

  • Azure DevOps or similar ticketing and defect tracking platforms.

  • Linux and Windows operating systems.

  • Cloud Platforms (Azure, AWS, or GCP).

Preferred

• Experience testing AI-enabled applications and Large Language Model (LLM) integrations.

• Familiarity with OWASP Top 10 for LLM Applications.

• Experience leveraging AI-assisted security testing tools and workflows.

EXPERIENCE

Required

• 3-5+ years of experience in penetration testing, application security, or cybersecurity engineering.

• Experience conducting application and network penetration tests in enterprise environments.

• Experience writing professional technical and executive-level security reports.

LEADERSHIP & COMMUNICATION

Required

• Strong verbal and written communication skills.

• Ability to communicate technical findings to technical and non-technical audiences.

• Strong collaboration skills with Security Leads, Managers, Developers, and Infrastructure teams.

• Ability to manage multiple projects and meet deadlines in a fast-paced environment.

• Strong analytical, troubleshooting, and problem-solving skills.

At RSM, we offer a competitive benefits and compensation package for all our people.  We offer flexibility in your schedule, empowering you to balance life’s demands, while also maintaining your ability to serve clients.  Learn more about our total rewards at https://rsmus.com/careers/working-at-rsm/benefits   https://rsmus.com/careers/el-salvador.html. 

RSM does not tolerate discrimination and/or harassment based on race; colour; creed; sincerely held religious beliefs, practices or observances; sex (including pregnancy or disabilities related to nursing); gender (including gender identity and/or gender expression); sexual orientation; HIV Status; national origin; ancestry; familial or marital status; age; physical or mental disability; citizenship; political affiliation; medical condition (including family and medical leave); domestic violence victim status; past, current or prospective service in the Salvadoran Military/Veteran status; pre-disposing genetic characteristics or any other characteristic protected under applicable provincial employment legislation.  

Accommodation for applicants with disabilities is available upon request in connection with the recruitment process and/or employment/partnership. RSM is committed to providing equal opportunity and reasonable accommodation for people with disabilities. If you require a reasonable accommodation to complete an application, interview, or otherwise participate in the recruiting process, please send us an email at careers@rsmus.com.