Penetration Tester

• 4+ years of experience in penetration testing, security assessment, or similar roles.
• Hands-on experience with pentesting platforms and tools (Kali or another dedicated OS; Burp Professional, Nmap, Metasploit, sqlmap, AMASS, etc.).
• Knowledge of OWASP Top 10 and familiarity with API, thick client, and LLM/AI attack surfaces.
• Scripting skills and working knowledge of at least one programming language and framework.
• Ability to work with diverse stakeholders and manage concurrent initiatives with good judgement and prioritization.
• Strong written and verbal communication skills in English; Spanish native or fluent is a plus.

• Experience with AI models and frameworks (e.g., OpenAI, Anthropic) and tooling (Obsidian, Ollama) is a plus.

Preferred

• Certifications: OSCP, CEH, GIAC (GPEN, GSEC, GWAB, GMOB, GCPN) or equivalent.
• Familiarity with MITRE ATT&CK, SAST/DAST, cloud testing, and reverse engineering.
• Experience in agentic development and deploying/hosting AI tools (containers, servers, APIs).
• Experience working in distributed teams and global projects.

Can you imagine taking part in the transformation of leading national and international organizations?

At Deloitte, we are committed to making an impact on society, our clients, and our people.

In this role you will be part of the Global Cyber Services team, delivering penetration testing services that combine tools, methodologies and manual analysis to evaluate and strengthen the security of applications, networks and environments for clients and the firm.

• Execute penetration testing engagements across multiple attack surfaces: web applications, APIs, networks, mobile, thick clients and AI/LLM-based systems.
• Design and perform automated and manual tests, producing clear, actionable, and prioritized findings for technical and non-technical audiences.
• Use and adapt testing platforms and tools (e.g., Kali Linux, Burp Suite, Nmap, Metasploit, sqlmap, AMASS, Postman/Swagger).
• Apply AI and LLM techniques (prompt engineering, agents, emerging frameworks) to accelerate reconnaissance and to generate or refine testing scripts.
• Develop, maintain, and validate AI-driven agents and tools to automate recurring testing tasks, reducing false positives and improving accuracy.
• Evaluate and integrate emerging AI-assisted offensive security tools into the team's methodologies and playbooks.
• Create and maintain technical documentation, methodologies, and standard operating procedures (SOPs).
• Communicate service capabilities and test results effectively to clients and global stakeholders.