Vulnerability Assessment & Penetration Testing Engineer

Job Summary We are seeking a Vulnerability Assessment & Penetration Testing Engineer to support vulnerability management and security assessment of a private cloud environment. The role involves hands-on vulnerability assessment (VA), penetration testing (PT), security validation and hardening of VMs, containers, hosts, network segments and Linux/RHEL-based systems.

Roles & Responsibilities Execute regular and ad-hoc vulnerability assessments across VMs, containers, hosts and network segments. Investigate and validate reported vulnerabilities, eliminate false positives, validate exploitability and assess security impact. Perform penetration testing and manual validation, including network, application/API and infrastructure testing as applicable. Assess RHEL/Linux security configurations, services, packages, permissions, users, file changes and SELinux configurations/events. Investigate OS/application logs, services, processes and ports, using tools and commands such as systemctl and journalctl. Perform security hardening and configuration reviews and validate security controls. Track remediation, perform retesting and verify vulnerability closure. Prepare technical and management-level vulnerability assessment and penetration testing reports. Support vulnerability management activities and work with relevant teams to drive remediation. Requirements Must Have Degree/Diploma in Cybersecurity, IT or equivalent. Minimum 3 years of relevant experience in VA/PT, vulnerability management or cybersecurity assessment. Hands-on experience in VA/PT and Linux/RHEL environments. Experience with SOC/SIEM environments. Good knowledge of Linux permissions, SELinux, systemctl, journalctl and server/application logs. Experience with vulnerability assessment tools such as Tenable/Nessus or Qualys. Strong understanding of vulnerability validation, exploitability assessment, security impact and remediation verification. Certifications RHCSA or RHCE. CREST penetration-testing certification. OSCP or equivalent. Security+ / CySA+ is advantageous.