---
title: 'Penetration Tester at A-LIGN External'
canonical: 'https://feeny.ai/job/penetration-tester-a-lign-external-united-states-v2dr6ca0tywp'
type: 'job'
last_seen: '2026-10-26'
---

# Penetration Tester at A-LIGN External

- **Company:** A-LIGN External
- **Location:** United States
- **Work type:** remote
- **Posted:** 2026-10-20
- **Last confirmed live:** 2026-10-26
- **Apply:** https://job-boards.greenhouse.io/align/jobs/8900412002

## Job description

## About the Role

The Penetration Tester works to execute offensive security activities for Pathfynder by A-LIGN. In this role, you will be responsible for the delivery of external network, web application, and API penetration testing engagements. As the Penetration Tester, you will provide exceptional technical and client-focused testing strategies to help support the continued growth of our fast-paced company. A-LIGN will depend on you as the Penetration Tester to independently identify and validate real-world security risks, manually exploit vulnerabilities, document findings, and communicate practical remediation guidance to clients.

Reports to

Director, Web Application & External Offensive Operations

Pay Classification

Full-Time, Exempt

## Responsibilities

- Execute external network, web application, and API penetration testing engagements
- Identify, validate, and manually exploit vulnerabilities using public exploits, custom-developed exploits, or a combination of techniques
- Evaluate findings in context, develop realistic attack paths, and accurately assess business and technical risk
- Deliver clear, accurate, client-ready reports that explain findings, risk ratings, evidence, and actionable remediation guidance
- Communicate technical issues, testing results, and remediation recommendations to client stakeholders
- Maintain project quality and timelines while executing assigned engagements with minimal oversight
- Collaborate with the offensive security team to evaluate tools, improve delivery methods, and share technical knowledge
- Mentor junior testers and contribute to the development of team capabilities and repeatable testing practices

## Minimum Qualifications

## EDUCATION

- Degree in in cybersecurity, computer science, a related discipline, or equivalent professional experience

## EXPERIENCE

- 5+ years of hands-on offensive security experience, including at least 3 years focused on external network, web application, or API penetration testing
- Experience performing web application penetration testing using black-box, grey-box, and white-box approaches
- Experience testing APIs, including REST, GraphQL, SOAP, or gRPC
- Proven ability to manage engagements from scoping and execution through reporting and client debriefs.
- Working knowledge of OWASP WSTG, OWASP ASVS, OWASP API Security Top 10, and PTES
- Consulting or client-facing security delivery experience is preferred
- Mobile application penetration testing experience across iOS or Android is preferred
- White-box or source-code-assisted testing experience is preferred

## CERTIFICATIONS

- Required at least one of the following: OSCP/OSCP+, OSWA, eWPT, HTB CWES, TCM PWPP, GWAPT, GPEN, or CREST CRT
- Preferred: OSWE, HTB CWEE, BSCP, eWPTX, CREST CCT APP, TCM PWPE, OSEP, or GXPN
- Published CVEs, conference presentations, or meaningful contributions to open-source security tooling may be considered in place of certifications

## SKILLS

- Advanced manual testing skills, including the ability to chain lower-severity findings into high-impact attack paths
- Advanced web exploitation knowledge, including access control and authorisation flaws, OAuth, SAML and JWT abuse, SSRF, deserialisation, request smuggling, race conditions, and business logic abuse
- Knowledge of external attack surfaces, including OSINT, asset discovery, edge-device exploitation, and SSO or MFA attack techniques
- Proficiency with scripting languages such as Python, Bash, JavaScript, PowerShell, or Go, including the ability to build custom tooling and exploits
- Proficiency with offensive security and assessment tools such as Burp Suite, Caido, Nmap, Nuclei, SQLmap, ffuf, Postman, and Nessus
- Familiarity with common application frameworks, including Laravel, Express.js, ASP.NET Core, Spring, and Django
- Ability to write clear, concise, client-ready reports with accurate risk ratings and actionable remediation guidance
- Excellent verbal and written communication skills, with the ability to explain technical risks to technical and non-technical audiences
- Ability to work independently and collaboratively in a fast-paced, remote environment while meeting deadlines.
- Experience assessing AI or LLM-integrated applications for prompt injection, jailbreaks, data leakage, and agent or tool abuse is preferred
- Familiarity with the OWASP Top 10 for LLM Applications and cloud attack surfaces across AWS, Azure, or GCP is preferred

## Benefits

- Healthcare, Dental, and Vision Benefits
- Employer Paid Life Insurance and Disability Insurance
- EAP - Employee Assistance Program
- Pet Insurance
- 401(k) Plan with Employer Matching
- Competitive Bonus Structure
- Technology Allowance
- Certification Reimbursement
- Personalized Career Coaching
- Generous Paid Time Off
- Paid Office Closure December 25-January 1
- Vacation Bonus
- Summer Hours

## About Pathfynder by A-LIGN

Pathfynder by A-LIGN is a technology-enabled cybersecurity company providing offensive and defensive cybersecurity services under A-LIGN, a security and compliance partner trusted by more than 2,400 global organisations to help mitigate cybersecurity risks. We work with organisations ranging from small businesses to global enterprises, with services spanning SOC, Penetration Testing, PCI DSS, HITRUST, ISO, and privacy compliance. Our proprietary compliance management platform is transforming the compliance experience by enabling an anytime, anywhere approach to audits. To learn more, visit A-LIGN.com.

Come Work for A-LIGN!

Apply online today at A-LIGN.com and learn about life at A-LIGN by following us on [LinkedIn.](https://www.linkedin.com/company/a-lign/posts/?feedView=all)

A-LIGN is an Equal Opportunity Employer. Minorities, women, disabled individuals, and veterans are encouraged to apply.

## About A-LIGN External

## Company Overview
- **One-liner**: A-LIGN is a technology-enabled security and compliance partner that helps organizations navigate cybersecurity risks through auditing, certification, and managed compliance services.
- **Entity Type**: Private (funding stage not disclosed)
- **Headquarters**: Tampa, Florida, United States (with additional offices in London, Galway, Panama City, Sofia, and Gurugram)
- **Founded**: 2009
- **Founders**: Not publicly available

## Core Business
- **Primary industry/industries**: Cybersecurity, Compliance, Audit, Risk Management
- **Target customers**: B2B – startups to global enterprises; heavily focused on regulated industries (tech, healthcare, government, finance)
- **Mission or purpose statement**: “Help companies like yours navigate the complexities of cybersecurity and compliance by offering customized solutions that align specifically with each organization's unique goals and objectives.” [a-lign.com](https://www.a-lign.com/about)

## Products & Services
- **SOC 1 and SOC 2 Audits**: Licensed auditor for System and Organization Controls reports.
- **ISO 27001 / 27701 / 22301 Certifications**: Accredited certification body for information security, privacy, and business continuity.
- **HITRUST CSF Assessment**: HITRUST CSF Assessor Firm.
- **FedRAMP**: Accredited 3PAO for cloud service provider authorizations.
- **CMMC (Cybersecurity Maturity Model Certification)**: C3PAO for defense supply chain compliance.
- **PCI DSS**: Qualified Security Assessor Company.
- **A-SCEND Platform**: Proprietary compliance management platform for evidence collection, audit tracking, and reporting.
- **Penetration Testing & Ransomware Preparedness**: Additional security testing services.

## Market Standing
- **Valuation/Market Cap**: Not disclosed
- **Key Metric**: Total funding not disclosed; key operational metrics include 6,400+ clients globally, 36,000+ audits completed, and 400+ auditors [a-lign.com](https://www.a-lign.com/).
- **Notable Investors/Partners**: Not publicly listed; partners with leading GRC automation tools (e.g., compliance automation providers) [a-lign.com](https://www.a-lign.com/).
- **Growth Signals**: Offices across 6 countries; recognized as #1 Top SOC 2 report issuer and Top 3 FedRAMP assessor; 96% customer satisfaction rating; expanded services to include CMMC and FedRAMP.

## Competitive Advantages
- **Single-provider model**: Offers the widest breadth of compliance frameworks (SOC, ISO, HITRUST, FedRAMP, PCI, CMMC) under one roof, reducing vendor fragmentation.
- **Proprietary technology**: A-SCEND platform streamlines audit evidence collection and communication.
- **Scale and reputation**: Largest issuer of SOC 2 and HITRUST reports; top FedRAMP assessor; trusted by thousands of organizations.
- **Quality focus**: 24-hour response time and high customer satisfaction (96%).

## Strategic Focus
- **Current priorities**: Continuing to expand global presence, deepening FedRAMP and CMMC capabilities, and enhancing the A-SCEND platform to further automate compliance workflows.
- **Direction for growth**: Pursuing new markets (government, healthcare, defense) and scaling the auditor workforce to meet demand.

## Why Work Here
- **Culture**: Emphasizes human connection, quality, integrity, and innovation. Core values: “Be all in”, “Commit to quality”, “Do the right thing”, “Innovate constantly”. Annual company event called CLIMB.
- **Workplace flexibility**: Multiple global locations; home office reimbursement suggests hybrid/remote options are available for some roles.
- **Benefits**: Healthcare/dental/vision, employer-paid life and disability insurance, 401(k) with match, generous PTO (including paid office closure Dec 25–Jan 1), summer hours, certification reimbursement, personalized career coaching, and access to A-LIGN University for continuous learning.
- **Diversity & Inclusion**: Prioritizes DEI; encourages individuals from all backgrounds to apply.
- **Career growth**: Opportunities to move between cybersecurity, audit, and operations tracks; sponsorship for certifications like CISA, CISSP, CEH.

## Sources
1. [a-lign.com/about](https://www.a-lign.com/about)
2. [a-lign.com/](https://www.a-lign.com/)
3. [a-lign.com/careers](https://www.a-lign.com/careers)
4. [linkedin.com/company/a-lign](https://www.linkedin.com/company/a-lign)
5. [boards.greenhouse.io/align](https://boards.greenhouse.io/align)

## Other roles at A-LIGN External

- [Internal Penetration Tester](https://feeny.ai/job/internal-penetration-tester-a-lign-external-united-states-883xn771dydq) — United States
- [Senior Director, Corporate Marketing](https://feeny.ai/job/senior-director-corporate-marketing-a-lign-external-united-states-5sjg0mghtbhv) — United States
- [Business Development Representative](https://feeny.ai/job/business-development-representative-a-lign-external-tampa-g0c1mvjzcya2) — Tampa, United States
- [DevSecOps Engineer](https://feeny.ai/job/devsecops-engineer-a-lign-external-panama-k6jqx30tx67b) — Panama
- [Business Development Manager](https://feeny.ai/job/business-development-manager-a-lign-external-tampa-c5tkpyyp4ntk) — Tampa, United States
- [Business Development Manager](https://feeny.ai/job/business-development-manager-a-lign-external-london-wmevmb76awgk) — London, United Kingdom
- [Senior Sales Enablement Specialist](https://feeny.ai/job/senior-sales-enablement-specialist-a-lign-external-united-states-a1ez4zwp21ab) — United States
- [Senior GRC Engineer](https://feeny.ai/job/senior-grc-engineer-a-lign-external-panama-city-np9mzn0cje3y) — Panama City, Panama
- [Account Executive, Expansion - Enterprise](https://feeny.ai/job/account-executive-expansion-enterprise-a-lign-external-united-states-d9kq1wj5mmhz) — United States
- [Panama Director of Operations](https://feeny.ai/job/panama-director-of-operations-a-lign-external-panama-city-9credhhr56az) — Panama City, Panama