About the role
Job Description
Must-Have Requirement
* Hands-on experience with AI-enabled penetration testing.
Location: Chaska, MN (Onsite) Duration: 12+ Months Contract
Roles and Responsibilities
* Leverage AI/GenAI to accelerate penetration-testing activities, including reconnaissance, test-case generation, analysis, scripting, and reporting.
* Conduct security testing of web applications, APIs, networks, cloud environments, and other systems.
* Identify, validate, and document security vulnerabilities and weaknesses.
* Perform controlled exploitation to assess the impact and risk of identified vulnerabilities.
* Execute vulnerability assessments using manual and automated testing tools.
* Prepare detailed security assessment reports with actionable remediation recommendations.
* Collaborate with development and infrastructure teams to resolve security issues.
* Conduct security reviews to ensure compliance with organizational and industry standards.
* Support secure software development practices and promote application security best practices.
Requirements
Required Qualifications
* Minimum 3+ years of experience in penetration testing and vulnerability assessments.
* Experience testing web applications, APIs, networks, and cloud environments.
* Hands-on experience with industry-standard security testing tools and exploit frameworks.
* Ability to identify, validate, document, and remediate security vulnerabilities.
* Knowledge of secure coding practices and application security concepts.
* Experience preparing security assessment reports and presenting findings to stakeholders.
* Understanding of cybersecurity threats, attack methodologies, and defense mechanisms.
* Certifications such as CEH, OSCP, GPEN, or PNPT are preferred.
Technical Skills
* Web Application Penetration Testing (OWASP Top 10)
* API Security Testing and Network Penetration Testing
* Vulnerability Assessment and Management
* Cloud Security Testing (AWS, Azure, or GCP)
* Mobile Application Security Testing (Android/iOS)
* Active Directory Security Assessments
* Security Risk Assessment and Threat Analysis
* Security Tools: Burp Suite Professional, OWASP ZAP, Metasploit, Nessus, Qualys, Nmap, Wireshark, and Kali Linux
* Scripting: Python, PowerShell, and Bash/Shell
* Security Frameworks: OWASP, PTES, and NIST
* Security Reporting and Remediation Recommendations
* Compliance Standards: ISO 27001, PCI-DSS, and SOC 2
AI and LLM Security Requirements
* Ability to assess prompt injection, insecure model/application interactions, sensitive information exposure, excessive agency, and other LLM application risks.
* Ability to identify attack surfaces across models, data, applications, APIs, RAG pipelines, and AI agents using frameworks such as MITRE ATLAS.
* Experience using approved LLM/AI tools for test-case generation, reconnaissance analysis, vulnerability analysis, scripting, and report generation.