Vulnerability Assessment & Penetration Testing Engineer

Job Summary

We are seeking a Vulnerability Assessment & Penetration Testing Engineer to support vulnerability management and security assessment of a private cloud environment. The role involves hands-on vulnerability assessment (VA), penetration testing (PT), security validation and hardening of VMs, containers, hosts, network segments and Linux/RHEL-based systems.

Roles & Responsibilities

• Execute regular and ad-hoc vulnerability assessments across VMs, containers, hosts and network segments.
• Investigate and validate reported vulnerabilities, eliminate false positives, validate exploitability and assess security impact.
• Perform penetration testing and manual validation, including network, application/API and infrastructure testing as applicable.
• Assess RHEL/Linux security configurations, services, packages, permissions, users, file changes and SELinux configurations/events.
• Investigate OS/application logs, services, processes and ports, using tools and commands such as systemctl and journalctl.
• Perform security hardening and configuration reviews and validate security controls.
• Track remediation, perform retesting and verify vulnerability closure.
• Prepare technical and management-level vulnerability assessment and penetration testing reports.
• Support vulnerability management activities and work with relevant teams to drive remediation.

Requirements

Must Have

• Degree/Diploma in Cybersecurity, IT or equivalent.
• Minimum 3 years of relevant experience in VA/PT, vulnerability management or cybersecurity assessment.
• Hands-on experience in VA/PT and Linux/RHEL environments.
• Experience with SOC/SIEM environments.
• Good knowledge of Linux permissions, SELinux, systemctl, journalctl and server/application logs.
• Experience with vulnerability assessment tools such as Tenable/Nessus or Qualys.
• Strong understanding of vulnerability validation, exploitability assessment, security impact and remediation verification.

Certifications

• RHCSA or RHCE.
• CREST penetration-testing certification.
• OSCP or equivalent.
• Security+ / CySA+ is advantageous.