Penetration tester (Ethical Hacker) | Ukraine

Description & Requirements

Who we are looking for

We are looking for a Penetration Tester (Ethical Hacker) with hands-on experience in web application and API security testing, a strong technical mindset, and an interest in emerging AI security challenges.

What we expect:

• Commercial experience in web application and API penetration testing and vulnerability assessment.
• Solid understanding of common web vulnerabilities (OWASP Top 10, OWASP API Security Top 10) and the ability to identify and exploit them manually, beyond scanner output.
• Working knowledge of penetration testing methodologies, such as OWASP WSTG.
• Confident use of Burp Suite and other common web security testing tools.
• Basic understanding of LLM-based applications and their typical attack surfaces, including prompt injection, insecure output handling, and excessive agency.
• Ability to assess the technical risks and business impact of identified vulnerabilities.
• Good spoken English and strong reading comprehension for client communication and working with technical documentation.
• Strong technical writing skills, including the ability to prepare clear, structured reports, instructions, templates, and guidelines.
• Commitment to continuous learning and professional development.
• Relevant professional certifications, such as BSCP, eWPTX, CPTS, COAE, CWEE, OSWE, OSAI, or equivalent, or willingness to pursue them.
  
  

Nice to have:

• Hands-on experience testing LLM-based applications, AI agents, or RAG systems, including familiarity with OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Experience using AI coding agents such as Claude Code, Codex CLI, Cursor, or similar tools in security-related work.
• Experience building AI-assisted testing solutions, including custom prompts and skills, MCP servers, tool integrations, and agentic workflows.
• Experience evaluating security tools and AI-driven solutions against real-world targets.
• Scripting or programming skills in Python, JavaScript/TypeScript, or Bash.
• Experience with source code security reviews.
• Hands-on experience in mobile application security testing.
• Experience with cloud security testing across Azure, AWS, or GCP.
• Knowledge of thick client and network penetration testing or reverse engineering.
• Involvement in security research, Hack The Box, CVE discoveries, bug bounty programs, or CTF competitions.
  
  

Your future role

• Perform security assessments and penetration tests for clients, focusing on web applications, APIs, and AI-powered solutions.
• Participate in mobile application, cloud security, and other penetration testing engagements as part of the team.
• Identify and validate security vulnerabilities, assess their potential impact, and provide actionable recommendations.
• Prepare and validate penetration testing reports, ensuring clarity, accuracy, and consistency.
• Communicate security findings to client teams, explain identified vulnerabilities, and address follow-up questions.
• Contribute to the development of internal tools and automation for AI-augmented security testing.
• Test and evaluate new security tools and AI-driven solutions.
• Help improve internal reporting standards, methodologies, and templates.
• Contribute to the team's shared knowledge base, including testing methodologies, checklists, and vulnerability finding templates.
  
  

What we offer

• Strong mentorship program with constructive feedback and a personalized development plan.
• Continuous learning and professional development opportunities, including training and support for obtaining relevant security certifications.
• Dedicated time and opportunities to experiment with and develop AI-augmented security testing approaches.
  
  

Selection process

• HR interview
• Technical interview
• Offer and onboarding
  
  

About Deloitte

Deloitte is one of the world's leading professional services organizations, providing audit and assurance, consulting, financial advisory, risk advisory, tax, and legal services.

With a presence in more than 150 countries and territories, Deloitte helps organizations address complex business challenges, embrace innovation, and create lasting impact.

At Deloitte, you will have the opportunity to work with talented professionals, develop your expertise, and contribute to meaningful projects in a collaborative and inclusive environment.

About the team

Our team focuses on identifying and assessing security vulnerabilities across web applications, APIs, and AI-powered solutions.

We work on a variety of client security engagements, including web and API penetration testing, while also contributing to mobile, cloud, and other security assessments.

Beyond client projects, we continuously improve our testing methodologies, reporting standards, and internal tools. We encourage knowledge sharing, technical development, and experimentation with AI-augmented security testing approaches.