About this role
Professionals who think like attackers, spend time in labs or CTFs for fun, and want to grow in offensive security will enjoy this position at Thoropass. The security team combines human expertise with AI tools to deliver penetration testing and compliance automation solutions for global clients. Team members work on web application, API, mobile, cloud, network, and LLM penetration testing engagements alongside senior testers.
This role exists to support growing customer demand for modern security assessments while helping shape the future of AI-assisted testing workflows. A successful candidate will bring foundational offensive security experience, a curious mindset, and the willingness to learn how to validate automated tool outputs manually.
What you will do
- Perform penetration testing across web applications, APIs, mobile platforms, cloud environments, networks, and LLMs using manual techniques and AI-assisted tools.
- Follow established methodologies based on internal playbooks and the OWASP Testing Guide during every engagement.
- Document security findings with clear reproduction steps, request and response pairs, risk ratings, and remediation recommendations.
- Contribute to the refinement of internal documentation, checklists, templates, and plugins based on practical testing experience.
- Collaborate with senior testers to support pre-engagement preparation and scoping conversations when required.
What you need
- Bring one to two years of professional, freelance, internship, or bug bounty experience in penetration testing or vulnerability assessment.
- Hold at least one required certification, such as the BSCP or OSCP.
- Demonstrate a foundational understanding of web application security concepts, including injection flaws and the OWASP Top 10.
- Show a willingness to incorporate AI tools into workflows while independently validating automated output.
- Exhibit a self-driven passion for security through CTFs, lab work, bug bounty programs, or relevant self-study.
- Communicate fluently in English with strong written and verbal skills suitable for technical and non-technical stakeholders.
Nice to have
- Published security research
- Responsible disclosures
- Security blog posts or conference talks
Benefits
- Competitive base salary
- Exceptional private healthcare
- Early equity in a fast-growing company
- Work-from-home model
- Flexible PTO
- Monthly wellness and home Wi-Fi stipend
Skills and tech stack
Questions candidates ask
Where is the team located and can I work remotely?
Thoropass operates as a virtual, global company with a presence in over 18 countries, and this position is available in LATAM and India with a work-from-home model.
What tools and technologies will I use on the job?
You will perform tests using both manual techniques and AI-assisted tools for reconnaissance, payload generation, and initial triage, while also working with AI-powered solutions like First Pass AI.
What kind of professional development and growth is available?
The company offers a structured growth path from junior to mid-level pentester with regular feedback, direct mentorship from senior professionals, and a budget for training, certifications, and conferences.