Penetration Tester (AI-Enabled)

Job Description

Must-Have Requirement

• Hands-on experience with AI-enabled penetration testing.

Location

Chaska, MN (Onsite)

Duration

12+ Months Contract

Roles and Responsibilities

• Leverage AI/GenAI to accelerate penetration-testing activities, including reconnaissance, test-case generation, analysis, scripting, and reporting.
• Conduct security testing of web applications, APIs, networks, cloud environments, and other systems.
• Identify, validate, and document security vulnerabilities and weaknesses.
• Perform controlled exploitation to assess the impact and risk of identified vulnerabilities.
• Execute vulnerability assessments using manual and automated testing tools.
• Prepare detailed security assessment reports with actionable remediation recommendations.
• Collaborate with development and infrastructure teams to resolve security issues.
• Conduct security reviews to ensure compliance with organizational and industry standards.
• Support secure software development practices and promote application security best practices.

Required Qualifications

• Minimum 3+ years of experience in penetration testing and vulnerability assessments.
• Experience testing web applications, APIs, networks, and cloud environments.
• Hands-on experience with industry-standard security testing tools and exploit frameworks.
• Ability to identify, validate, document, and remediate security vulnerabilities.
• Knowledge of secure coding practices and application security concepts.
• Experience preparing security assessment reports and presenting findings to stakeholders.
• Understanding of cybersecurity threats, attack methodologies, and defense mechanisms.
• Certifications such as CEH, OSCP, GPEN, or PNPT are preferred.

Technical Skills

• Web Application Penetration Testing (OWASP Top 10)
• API Security Testing and Network Penetration Testing
• Vulnerability Assessment and Management
• Cloud Security Testing (AWS, Azure, or GCP)
• Mobile Application Security Testing (Android/iOS)
• Active Directory Security Assessments
• Security Risk Assessment and Threat Analysis
• Security Tools: Burp Suite Professional, OWASP ZAP, Metasploit, Nessus, Qualys, Nmap, Wireshark, and Kali Linux
• Scripting: Python, PowerShell, and Bash/Shell
• Security Frameworks: OWASP, PTES, and NIST
• Security Reporting and Remediation Recommendations
• Compliance Standards: ISO 27001, PCI-DSS, and SOC 2

AI and LLM Security Requirements

• Ability to assess prompt injection, insecure model/application interactions, sensitive information exposure, excessive agency, and other LLM application risks.
• Ability to identify attack surfaces across models, data, applications, APIs, RAG pipelines, and AI agents using frameworks such as MITRE ATLAS.
• Experience using approved LLM/AI tools for test-case generation, reconnaissance analysis, vulnerability analysis, scripting, and report generation.