Junior Penetration Tester

About PoCForge
PoCForge is a cyber security company specialising in hands-on penetration testing and proof-of-concept driven security assessments. We help organisations find and fix real, exploitable weaknesses before attackers do. Learn more at pocforge.com.
About the Role
We are looking for a curious, motivated Junior Penetration Tester to join our remote team. You will work alongside senior testers on web, API, network and cloud engagements, learning our methodology and gradually taking ownership of assessments. Success in this role means delivering accurate, well-documented findings with clear proof-of-concepts and practical remediation advice that clients can act on.
Responsibilities
Perform authorised penetration tests on web applications, APIs, internal/external networks and cloud environments under the guidance of senior testers
Identify, validate and safely demonstrate vulnerabilities (e.g. OWASP Top 10, misconfigurations, privilege escalation)
Conduct reconnaissance and vulnerability scanning, and manually verify results to eliminate false positives
Write clear, accurate technical reports with risk ratings, reproducible proof-of-concepts and remediation guidance
Support retesting to confirm that reported issues have been fixed
Stay current with new vulnerabilities, attack techniques and security tooling
Follow rules of engagement, scope and confidentiality requirements on every engagement
Qualifications
0–2 years of experience in penetration testing, bug bounty, CTFs or a related security role
Solid understanding of networking (TCP/IP, DNS, HTTP/S) and common web technologies
Working knowledge of the OWASP Top 10 and common attack techniques
Hands-on experience with tools such as Burp Suite, Nmap, Metasploit and Kali Linux
Familiarity with Linux and Windows environments, and basic scripting (Python, Bash or PowerShell)
Strong written and verbal communication skills in English
A degree in Computer Science, IT or a related field, or equivalent practical experience
Nice to Have
Certifications such as eJPT, CEH, PNPT, OSCP or CompTIA PenTest+
Bug bounty acknowledgements, CVEs, or a public CTF/HackTheBox/TryHackMe profile
Exposure to Active Directory, mobile application or cloud (AWS/Azure/GCP) security testing
What We Offer
Fully remote work
Mentorship from experienced penetration testers and exposure to real client engagements
Support for training and security certifications
A clear growth path towards a Penetration Tester / Senior role

Work arrangement
Yes