Junior Penetration Tester

SUMMARY:
Join the team at Barefoot Cyber!

Barefoot Cyber is a partner at IT Naledi Solutions. 

If you're ready to take the next step in your career, we'd love to hear from you: employment@itnaledi.co.za 

See below for details on this exciting opportunity:

We’re hiring a Junior Penetration Tester to support infrastructure security assessments and grow into application and cloud testing over time. You’ll work alongside senior consultants, follow repeatable testing playbooks, and produce clear, client-ready findings. This role is ideal for someone with solid fundamentals, good discipline, strong curiosity and who wants a structured path toward CEH, OSCP, and beyond.

• Deliver consistent, repeatable infrastructure security assessments with supervision.
• Write clear, evidence-based findings with practical remediation guidance.
• Build capability over time into web application testing and cloud security testing.
• Progress through training milestones aligned to CEH → OSCP, plus supporting certs.

Growth Path: Application & Cloud (Progressive)

• Web application testing fundamentals (OWASP Top 10, auth/session flaws, access control, input validation, etc.)
• API testing basics (auth, abuse cases, exposure and misconfigurations)
• Cloud assessment fundamentals (AWS/Azure): IAM, storage exposure, network controls, logging, and secure configuration baselines

POSITION INFO:
Responsibilities 

• Perform scoped vulnerability validation and security checks across:
  • Windows and Linux endpoints/servers
  • Active Directory basics (identity, authentication, common misconfigurations)
  • Network services and exposures (SMB, RDP, SSH, HTTP/S, DNS, etc.)
  • Perimeter and segmentation observations (where applicable)
• Use established tooling and playbooks to:
  • Enumerate assets and services
  • Validate findings (reduce false positives)
  • Identify weak configurations and common attack paths
• Assist with internal quality control:
  • Evidence gathering (screenshots, command output, logs)
  • Reproducibility steps
  • Risk ratings aligned to our reporting standard

• Draft assessment reports including:
  • Executive summary (simple and accurate)
  • Technical findings with evidence and impact
  • Prioritised remediation recommendations
• Participate in internal walkthroughs and client readouts (as confidence grows)

• Solid foundational understanding of:
  • TCP/IP networking, ports/services, routing/firewalls (basic)
  • Windows and Linux fundamentals (users, permissions, services, logs)
  • Security concepts: least privilege, authentication, patching, segmentation
• Comfortable working in a terminal (Linux + basic PowerShell)
• Ability to follow a testing methodology and document work clearly
• Professional communication: can explain technical issues simply and accurately
• Integrity and responsibility: understands sensitivity of client environments and data

• Exposure to common security tools (any of): Nmap, Nessus/OpenVAS, Burp Suite, Metasploit (basic), BloodHound (intro), Wireshark
• Home lab experience (AD lab, Hack The Box / TryHackMe / VulnHub)
• Basic scripting (Python/Bash/PowerShell) for automation and repeatability
• Familiarity with OWASP Top 10 or cloud fundamentals (AWS/Azure)

• Strong attention to detail (testing evidence must be reproducible)
• Calm, methodical approach under guidance

• Relevant diploma/degree or demonstrable equivalent practical experience (labs, portfolio, write-ups)

• CEH (or studying toward it)
• eJPT / PNPT / Security+ / Network+ (any of these beneficial)
• Strong intention and readiness to pursue OSCP within a defined timeframe
• Willingness to learn continuously and accept feedback