Senior Penetration Tester

Pakistan Digital Authority is seeking a highly skilled Senior Penetration Tester to join their team in Islamabad. The successful candidate will perform advanced offensive security assessments to identify and exploit vulnerabilities across a wide range of environments including applications, APIs, mobile platforms, networks, cloud infrastructure, and identity systems. This role demands expertise in manual penetration testing, adversary simulation, scripting, and risk assessment, going beyond automated scanning tools to provide comprehensive security evaluations and actionable insights.

Key Responsibilities
Plan and execute thorough penetration tests on web and mobile applications, APIs, internal and external networks, servers, cloud environments, databases, and security controls. Validate vulnerabilities through controlled exploitation and uncover weaknesses that automated tools may miss. Conduct in-depth testing for authentication, authorization, session management, injection flaws, business logic errors, and cryptographic weaknesses in line with OWASP Top 10 and API Security standards. Perform mobile security assessments on Android and iOS platforms, including static and dynamic analysis, reverse engineering, certificate validation, and runtime protection mechanisms.

Assess network and infrastructure security by evaluating service enumeration, segmentation, firewall rules, VPN access, Active Directory configurations, privilege escalation paths, and lateral movement opportunities. Lead red team exercises simulating real-world adversary tactics such as reconnaissance, initial access, persistence, and privilege escalation, while collaborating with SOC and Blue Teams to enhance detection and response capabilities. Independently validate scanner findings, develop proof-of-concept exploits, and analyze attack paths to determine technical and business impacts with minimal disruption.

Evaluate security architecture from an attacker’s perspective, focusing on network segmentation, trust relationships, authentication mechanisms, third-party integrations, and cloud services, recommending practical improvements. Develop custom scripts and tools using Python, Bash, PowerShell, JavaScript, and SQL to automate testing, analyze logs, and extend existing security tools. Collaborate with development, infrastructure, and security teams to provide remediation guidance, conduct retesting, and confirm vulnerability closure. Prepare detailed technical and executive reports outlining findings, impact assessments, remediation steps, and retest outcomes.

Required Qualifications
A Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Computer Engineering, or a related field from an HEC-recognized institution is mandatory. The candidate must hold the OSCP certification. A minimum of six years of hands-on experience in penetration testing and offensive security is required, demonstrating expertise across multiple domains beyond automated vulnerability scanning.

Preferred Qualifications and Benefits
Advanced certifications such as OSWE, OSEP, OSED, GXPN, GPEN, CRTO, CREST, or GIAC offensive-security credentials are highly desirable. Experience in sectors such as banking, payment systems, fintech, telecommunications, government, or critical infrastructure will be considered a strong advantage. Proficiency with industry-standard tools including Burp Suite Professional, OWASP ZAP, Postman, Nmap, Nessus, Metasploit, Impacket, BloodHound, Responder, CrackMapExec, Wireshark, MobSF, Frida, JADX, apktool, Ghidra, ADB, and Kali Linux is essential.

Candidates should demonstrate advanced skills in manual penetration testing, web and mobile security, network and Active Directory assessments, red teaming, attack-path analysis, cloud and container security, identity and access management, threat modeling, and scripting for automation. Strong analytical thinking, professional judgment, confidentiality, and the ability to produce clear technical and executive reports are critical for success in this role.

Applications will be accepted until the position is filled, with an initial deadline of 15 days from the publication date. Interested candidates are encouraged to apply promptly to be considered for this challenging and impactful role within Pakistan Digital Authority.

Skills

Security Architecture & Threat Modelling Professional Judgment & Confidentiality Analytical Thinking Technical & Executive Security Reporting Remediation Validation & Retesting Risk Assessment & Business Impact Analysis Automation & Custom Security Tooling Scripting OWASP & MITRE ATT&CK Frameworks Windows/Linux & Network Protocols TCP/IP Advanced Manual Penetration Testing & Identity & Access Management Security Container & CI/CD Security Cloud Vulnerability Validation & Proof-of-Concept Attack-Path Analysis & Vulnerability Chaining Red Teaming & Adversary Simulation Infrastructure & Active Directory Security Network API & Mobile Application Security WEB

Job Details

Total Positions:

1 Post

Job Shift:

Full Time

Job Type:

First Shift (Day)

Job Location:

Islamabad, Pakistan

Gender:

No Preference

Age:

18 - 65 Years

Minimum Education:

Bachelors

Degree Title:

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Computer Engineering, or a related discipline from an HEC-recognized institution. OSCP certification is mandatory. Advanced certifications such as OSW

Career Level:

Manager

Experience:

6 Years - 10 Years

Apply Before:

Oct 14, 2026

Posting Date:

Oct 08, 2026