Ethical Hacking Trainer

About the role

Ethical Hacker

Key responsibilities

• Plan and execute authorized penetration tests (web, mobile, API, network, cloud, wireless, IoT, and internal/external infrastructure).
  
• Perform red team exercises and adversary emulation to evaluate detection and response capabilities.
  
• Conduct vulnerability assessments and prioritize findings by business impact and exploitability.
  
• Exploit discovered vulnerabilities safely to demonstrate risk, then produce stepbystep remediation guidance.
  
• Perform secure code reviews and threat modeling with development teams.
  
• Create detailed, actionable reports with proof-of-concept evidence, risk ratings, and mitigation recommendations.
  
• Work with engineering, DevOps, and security teams to validate fixes and support remediation verification.
  
• Help design and tune detection rules (SIEM, EDR) and playbooks for common attack patterns.
  
• Maintain and extend internal pentest tooling, scripts, and automation.
  
• Stay current with threat intelligence, exploit techniques, and emerging vulnerabilities.
  
• Provide security training, run tabletop exercises, and mentor junior security engineers.
  

Required qualifications

• Bachelors degree in Computer Science, Cybersecurity, or equivalent experience (or relevant military/security background).
  
• 3+ years of hands-on experience in penetration testing, vulnerability assessment, or offensive security.
  
• Demonstrable experience testing web applications, APIs, and network services.
  
• Strong familiarity with common attack techniques (OWASP Top 10, SANS Top 25, common cloud misconfigurations).
  
• Proficiency with offensive/security toolset: Burp Suite, Nmap, Metasploit, SQLmap, Wireshark, Nessus/OpenVAS, Hydra, etc.
  
• Comfortable with Linux and Windows internals, networking protocols, and scripting (Python, Bash, PowerShell).
  
• Experience testing cloud environments (AWS, Azure, GCP) and container/Kubernetes security.
  
• Strong written and verbal communication able to produce concise technical reports and explain risk to nontechnical stakeholders.
  

Preferred / Nice-to-have

• Professional certifications: OSCP, OSCE, CEH, eJPT, CREST, GIAC (GPEN, GWAPT), CISSP, or equivalent.
  
• Experience with red-team frameworks and adversary emulation (MITRE ATT&CK).
  
• Experience with mobile app (iOS/Android) and IoT/embedded device testing.
  
• Familiarity with secure SDLC, SCA (software composition analysis), and SAST/DAST tools.
  
• Prior experience building tooling or exploits, and publishing research or CTF participation.
  
• Knowledge of compliance frameworks: PCI-DSS, ISO 27001, SOC2, HIPAA (as applicable).
  

Tools & technologies youll likely use

Kali Linux, Parrot, Burp Suite (Pro), Metasploit, Nmap, Nessus / OpenVAS, Wireshark, sqlmap, Hydra, DirBuster/FFUF, Mimikatz, BloodHound, Impacket, Docker/K8s tooling, AWS/Azure/GCP CLIs, Python/Go/Ruby scripts, Git, SIEM/EDR consoles.

Soft skills

• Highly ethical, trustworthy, and respects scope and rules of engagement.
  
• Analytical thinker with strong problemsolving skills.
  
• Comfortable working independently and in cross-functional teams.
  
• Patient teacher able to mentor engineers with remediation guidance.
  
• Strong attention to detail and a methodical testing approach.