Athena Institute of Business and Technology (AIBT) is building Africa’s next generation of business, policy, and tech leaders, through flexible, practical, and impact-driven learning.
We are recruiting to fill the position below: Job Title: Engineer - Penetration Testing Location: Remote Employment Type: Full-time
Job Description
We are seeking a skilled and detail-oriented Penetration Testing Engineer to identify, assess, and help remediate security vulnerabilities across the organization's IT infrastructure, applications, networks, and cloud environments.
The successful candidate will conduct authorized security assessments and penetration tests to evaluate the effectiveness of existing security controls, simulate realistic attack scenarios, and provide actionable recommendations to strengthen the organization's cybersecurity posture.
The ideal candidate should possess strong technical expertise in ethical hacking, vulnerability assessment, security testing methodologies, and risk analysis, with a commitment to responsible and authorized security testing.
Key Responsibilities
Conduct authorized penetration testing and security assessments across networks, web applications, APIs, mobile applications, cloud environments, and enterprise systems.
Identify, exploit, validate, and document security vulnerabilities within the approved scope of engagement.
Perform vulnerability assessments, security configuration reviews, and controlled attack simulations to identify potential weaknesses.
Assess applications and systems for common security risks, including those outlined in the OWASP Top 10.
Evaluate network security controls, authentication mechanisms, access controls, encryption, and system configurations.
Conduct internal and external network penetration tests, where authorized.
Use industry-standard security testing tools to identify vulnerabilities and validate potential attack paths.
Perform manual testing alongside automated scanning to reduce false positives and identify complex security issues.
Assess cloud infrastructure and configurations for security weaknesses, excessive permissions, and exposure risks.
Prepare clear technical reports documenting findings, evidence, severity ratings, business impact, and recommended remediation measures.
Work with developers, system administrators, network engineers, and cybersecurity teams to prioritize and resolve identified vulnerabilities.
Conduct retesting to verify that remediation activities have effectively addressed reported security issues.
Support red-team exercises, security validation activities, and incident response investigations where required.
Maintain accurate records of testing activities, tools used, findings, and remediation status.
Ensure all testing activities comply with approved scopes, rules of engagement, confidentiality requirements, and applicable laws and organizational policies.
Keep abreast of emerging threats, attack techniques, vulnerabilities, and penetration testing methodologies.
Requirements Education:
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, Software Engineering, or a related discipline.
Relevant professional training in penetration testing, ethical hacking, application security, or information security will be an added advantage.
Industry-recognized cybersecurity certifications are desirable.
Equivalent practical experience, technical proficiency, and demonstrable security testing skills may be considered.
Experience:
Minimum of 3–5 years of relevant experience in penetration testing, offensive security, vulnerability assessment, or application security.
Demonstrable experience conducting authorized penetration tests and security assessments across networks, applications, or cloud environments.
Practical experience using industry-standard penetration testing tools and validating vulnerabilities through manual testing.
Experience preparing professional penetration testing reports with clear evidence, risk ratings, and actionable remediation guidance.
Experience collaborating with IT operations, developers, system administrators, and security teams to resolve identified vulnerabilities.
Demonstrated understanding of security testing methodologies, rules of engagement, and responsible disclosure practices.
Experience with enterprise environments, regulated industries, or complex cloud infrastructures will be an advantage.
Required Skills:
Strong understanding of cybersecurity principles, ethical hacking, and penetration testing methodologies.
Practical experience with network protocols, TCP/IP, DNS, HTTP/HTTPS, routing, firewalls, and network security.
Proficiency with penetration testing tools such as Burp Suite, Nmap, Wireshark, Metasploit, and vulnerability scanners.
Knowledge of web application security, API security, authentication, authorization, session management, and common application vulnerabilities.
Familiarity with the OWASP Top 10 and relevant security testing standards and frameworks.
Experience with vulnerability assessment, risk analysis, exploit validation, and security reporting.
Working knowledge of Linux and Windows operating systems, system administration, and security configurations.
Scripting or programming skills in Python, Bash, PowerShell, or similar languages to automate testing tasks.
Understanding of Active Directory security, privilege escalation, and identity and access management.
Familiarity with cloud security testing across platforms such as AWS, Microsoft Azure, or Oracle Cloud Infrastructure (OCI).
Knowledge of security frameworks and standards such as NIST, CIS Benchmarks, and ISO/IEC 27001.
Strong analytical thinking, problem-solving, attention to detail, and technical documentation skills.
Ability to communicate technical findings and remediation recommendations to both technical and non-technical stakeholders.
High ethical standards and a strong commitment to confidentiality and responsible vulnerability disclosure.
Additional Advantage:
Experience with mobile application penetration testing and API security assessments.
Knowledge of container security, Kubernetes, and cloud-native application security.
Familiarity with source code review, software composition analysis, and secure software development practices.
Experience with red teaming, adversary simulation, or threat modelling.
Experience with bug bounty programs and responsible vulnerability disclosure.
Relevant certifications such as Offensive Security Certified Professional (OSCP), CompTIA PenTest+, Certified Ethical Hacker (CEH), or equivalent qualifications.