Penetration Tester

Penetration Tester 

Location: Remote - North America

Company Mission – Our mission is to help secure as many companies as possible, by using the best way of doing so: penetration testing. Sprocket Security prioritizes offensive security for enterprises, empowering them to build robust defense strategies based on individual business risk.

How – At Sprocket Security, we've built an expert-driven Continuous Penetration Testing platform that blends cutting-edge automated and manual testing methods.

Your Mission – The easy work is disappearing, and we built it that way on purpose. Our platform now owns the recon, the scanning, the first pass anyone could run, so you start each day with leads already surfaced instead of a blank terminal. Your job is everything the tooling can't do: chasing a lead into a critical finding, going back into the same network a third time because you know there's more in it, and being the human a client trusts when the report lands.

Responsibilities:

• Own continuous testing across your clients' full attack surfaces (network, web app, cloud, social engineering) by conducting manual penetration testing and directing automation and agents rather than running one-off scoped projects.
• Take raw leads the platform surfaces and push them into deep, chained, business-level impact, including post-exploitation, lateral movement, and privilege escalation.
• Validate whether activity was detected and acted on, not just whether you got in, and call out where a client's defenses held.
• Write clear, business-relevant attack narratives that explain impact to technical and non-technical audiences.
• Run debriefs and client conversations that build trust and position Sprocket as a partner, not a vendor.
• Feed repeatable techniques and automation candidates back to R&D so a one-off discovery becomes a capability the whole team runs continuously.
• Mentor junior testers and interns, stay reachable, and think out loud with your team rather than working in silence.
• Build scripts and tooling to improve your own efficiency and the team's.

Requirements:
Minimum

• Web application testing beyond OWASP Top 10 basics: auth flaws, business logic, injection at depth.
• Network and Active Directory testing: lateral movement, privilege escalation, not just scan-and-report.
• Comfort directing, supervising, and validating AI and automation tooling across the full autonomy spectrum, and pushing well past what it surfaces on its own.