WHO WE ARE LOOKING FOR
Penetration Testing Specialist at CICADA8
WHAT WE DO
The team performs offensive cybersecurity tasks. We implement projects of various levels of complexity and specifics: from classic penetration testing to cyberattack simulations (red/purple team) and hardware security analysis.
RESPONSIBILITIES
- Conducting security assessment and penetration testing projects for the external perimeter;
- Infrastructure research: domains, ASNs, applications, cloud services;
- Source code analysis, vulnerability discovery and verification;
- Development and adaptation of tools for automating vulnerability discovery and exploitation;
- Participation in Red Team assessments and attack modeling;
- Discovery of 0-day vulnerabilities, development of PoCs and 1-day exploits;
- Report preparation with reproduction steps and remediation recommendations;
- Participation in training, development of internal team methodologies and knowledge base.
WHAT YOU NEED FOR THIS JOB
- 1+ year of experience;
- Experience conducting attacks on the external perimeter and exploiting vulnerabilities at the infrastructure and application level;
- Deep understanding of web technologies: HTTP/HTTPS, REST/GraphQL, WebSockets, CORS, session mechanisms, authorization (JWT, OAuth2, SSO);
- Experience in discovering and exploiting server-side vulnerabilities: RCE, SQLi, SSRF, XXE, LFI/RFI, Path Traversal, Race Conditions, Insecure Deserialization, Business Logic Bugs;
- Confident reading and analysis of source code typical for web stacks;
- Windows and Linux — internal architecture, typical security mechanisms, service components, administration tools;
- Network technologies — TCP/IP, DNS, SMB, RPC, HTTP(S), VPN, VLAN protocols, routing and traffic filtering;
- PoC/exploit and tool development skills (Python, Go, PowerShell, Bash);
- Understanding of defense evasion techniques and activity hiding during attacks;
- Proficiency with tools: Burp Suite Pro, Nmap, sqlmap, wfuzz, Metasploit, Wireshark, amass, etc.;
- Knowledge of MITRE ATT&CK and TTP scenario building methods;
- Welcome: BSCP, OSWA, OSWE, OSCP, CRTO, OSEP, eCPPT, CVE/BDU publications, bug bounty reports, personal developments and research.
WHAT WE OFFER
- Hybrid or remote work format;
- Voluntary medical insurance from the first month of employment — 100% coverage of all medical expenses, including dentistry;
- Favorable discounts and special offers from partners for fitness, English courses, and other useful activities;
- Opportunity to regularly improve your skills: participation in external events, meetups, training, possibility of annual certification exams;
- Work in a team of experienced Senior specialists, CTF competition winners;
- Open and friendly corporate culture, where everyone feels part of a cohesive team, communicates on an equal footing, and is always on "you" terms. We value everyone's contribution, support initiative, and create comfortable conditions for professional and personal growth.
