Penetration Tester

About the role

The Penetration Tester delivers penetration tests to improve the software and infrastructure security of the CMA CGM Group. Reporting to the Group Head of Application Security, the role is that of a deep technical security expert who validates the proper security implementation of Group assets. Proven experience in red team assessments and infrastructure penetration tests is required.

Key responsibilities

• Deliver application penetration tests on web applications, APIs, mobile applications and thick client applications
• Deliver infrastructure penetration tests on Active Directory, Wi-Fi, networks and similar systems
• Identify full compromise paths and kill chains, and compromise modern infrastructures (containerized, microservices) and cloud platforms (AWS, GCP, Azure)
• Provide technical expertise to other services such as SOC and Forensics
• Recommend mitigations to remediate vulnerabilities
• Coordinate with IT and business teams to prepare and organise penetration tests

Required profile

• Bachelor's or Master's degree in Computer Science, Information Technology or a relevant field
• 5-8 years of experience in penetration testing
• Proven experience with infrastructure penetration tests and red team assessments
• Fluent English is mandatory; French is optional
• Excellent communication skills, able to explain technical topics to technical and non-technical audiences, and the ability to work with third parties, internal teams and international business units

Required skills

• OWASP Top 10 and CWE knowledge
• Understanding of microservices architectures and APIs
• Tools such as Burp Suite, ZAP and Kali Linux
• Networking skills: routing, encapsulation, VPN, firewalling, DNS
• Certifications such as OSCP, OSWE or OSCE are an advantage