Penetration Tester

Job not on LinkedIn

🕒 May 8

🇲🇽 Mexico – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🔧 QA Engineer (Quality Assurance)

👻 Ghost score 38%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Bishop Fox

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2007

💼 Consulting

📦 Logistics

📣 Marketing

💰 $46M Series B on 2022-11

Consulting • Logistics • Marketing

Bishop Fox is a leader in offensive security, offering a range of continuous security solutions to protect dynamic attack surfaces. Their services include attack surface management, application penetration testing, cloud security assessments, network security, and more. They focus on proactive defense strategies, subjecting clients' networks to real-world attack scenarios to bolster security resilience. Bishop Fox collaborates with major partners like Google, Facebook, and Amazon, ensuring robust security solutions for complex ecosystems. Their commitment to advancing security is rooted in innovative research and collaboration with the broader cybersecurity community.

📋 Description

• Perform hands-on security testing across cloud-native, mobile, backend, and AI-enabled environments • Analyze application behavior and review source code • Identify realistic exploitation scenarios • Validate security controls across modern architectures • Work closely with clients and internal teams to deliver technical assessments and actionable remediation guidance • Contribute throughout the engagement lifecycle, from scoping and test planning to execution, reporting, and client presentations • Assess cloud security, mobile applications, hybrid applications, and AI/LLM security

🎯 Requirements

• 4+ years of experience in application security assessments, penetration testing, or offensive security engagements • Strong understanding of application security fundamentals, modern attack techniques, and vulnerabilities affecting web applications, APIs, mobile applications, and cloud-native environments • Hands-on experience testing REST APIs, including authentication/authorization flaws, IDORs, injection vulnerabilities, session management issues, and business logic flaws • Strength with AWS services and cloud security concepts, including IAM, STS, S3, Lambda, API Gateway, CloudTrail, CloudWatch, and SigV4 • Solid understanding of networking and web fundamentals, including HTTP/HTTPS, TCP/IP, DNS, API communication flows, cookies, and headers • Experience reviewing source code for security issues in Java, C#, and Python applications • Knowledge of secure coding principles and risks such as SSRF, insecure deserialization, injection vulnerabilities, sensitive data exposure, and insecure cloud integrations • Understanding of SDLC, CI/CD pipelines, and secure development practices • Experience using Burp Suite, Semgrep, Git, AWS CLI, and API testing/debugging tools • Comfortable working across Linux, Windows, and macOS environments • Experience or strong interest in AI/LLM security, including prompt injection, RAG risks, insecure integrations, excessive permissions, and the OWASP Top 10 for LLM Applications • Strong written and verbal communication skills, with ability to communicate technical risks to technical and executive stakeholders • Experience following structured testing methodologies, documentation standards, and validation/retesting workflows • Ability to manage multiple concurrent engagements while maintaining high-quality deliverables and attention to detail • Must be authorized to work in Mexico for the duration of employment without sponsorship • All new hires must pass a background check • Nice to have: exposure to hardware or embedded device security testing; familiarity with cloud-native and serverless architectures; consulting or client-facing experience; relevant security certifications or hands-on research contributions

🏖️ Benefits

• Generous Time Off and Company-Wide Holidays • Team Events and International Travel Opportunities • Work From Home Support • Training Budget • Saving Fund • Food Coupons • Health and Wellbeing programs