Penetration Tester (AI-Enabled)

Job Description

Must-Have Requirement

• Hands-on experience with AI-enabled penetration testing.

Location: Chaska, MN (Onsite)
Duration: 12+ Months Contract

Roles and Responsibilities

• Leverage AI/GenAI to accelerate penetration-testing activities, including reconnaissance, test-case generation, analysis, scripting, and reporting.

• Conduct security testing of web applications, APIs, networks, cloud environments, and other systems.

• Identify, validate, and document security vulnerabilities and weaknesses.

• Perform controlled exploitation to assess the impact and risk of identified vulnerabilities.

• Execute vulnerability assessments using manual and automated testing tools.

• Prepare detailed security assessment reports with actionable remediation recommendations.

• Collaborate with development and infrastructure teams to resolve security issues.

• Conduct security reviews to ensure compliance with organizational and industry standards.

• Support secure software development practices and promote application security best practices.

Required Qualifications

• Minimum 3+ years of experience in penetration testing and vulnerability assessments.

• Experience testing web applications, APIs, networks, and cloud environments.

• Hands-on experience with industry-standard security testing tools and exploit frameworks.

• Ability to identify, validate, document, and remediate security vulnerabilities.

• Knowledge of secure coding practices and application security concepts.

• Experience preparing security assessment reports and presenting findings to stakeholders.

• Understanding of cybersecurity threats, attack methodologies, and defense mechanisms.

• Certifications such as CEH, OSCP, GPEN, or PNPT are preferred.

Technical Skills

• Web Application Penetration Testing (OWASP Top 10)

• API Security Testing and Network Penetration Testing

• Vulnerability Assessment and Management

• Cloud Security Testing (AWS, Azure, or GCP)

• Mobile Application Security Testing (Android/iOS)

• Active Directory Security Assessments

• Security Risk Assessment and Threat Analysis

• Security Tools: Burp Suite Professional, OWASP ZAP, Metasploit, Nessus, Qualys, Nmap, Wireshark, and Kali Linux

• Scripting: Python, PowerShell, and Bash/Shell

• Security Frameworks: OWASP, PTES, and NIST

• Security Reporting and Remediation Recommendations

• Compliance Standards: ISO 27001, PCI-DSS, and SOC 2

AI and LLM Security Requirements

• Ability to assess prompt injection, insecure model/application interactions, sensitive information exposure, excessive agency, and other LLM application risks.

• Ability to identify attack surfaces across models, data, applications, APIs, RAG pipelines, and AI agents using frameworks such as MITRE ATLAS.

• Experience using approved LLM/AI tools for test-case generation, reconnaissance analysis, vulnerability analysis, scripting, and report generation.