Penetration Tester
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills. Possibly also "Preferred" could be part of Qualifications or Skills? The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Skills). So we can have sections: About the role, Responsibilities, Requirements, Qualifications, Skills. The "Preferred" could be part of Qualifications or Skills. We could treat "Preferred" as part of Qualifications (maybe as a subsection). But we must not invent sections with filler. We can include a Qualifications
and include both Required and Preferred lists under it. Or we could separate Required and Preferred as subheadings? Not allowed; only those headings. So we combine.
Similarly Skills: maybe we can extract skills from the posting: "Ability to effectively communicate...", "Proficient at analyzing...", "Ability to manage concurrent initiatives...", "Strong written and verbal communication skills", "Working knowledge of one scripting language...", "Familiarity with at least one software programming language and framework", "Demonstrated experience working with diverse stakeholders...", etc. Those could go under Skills.
But we must not invent content; we must preserve all substantive information. So we need to extract all substantive info and place it appropriately.
Let's parse the posting:
- Intro: "Deloitte Global is the engine of the Deloitte network..." That's about the company; could be About the role? Might be considered boilerplate? It's not a standard boilerplate like EEO; it's descriptive of the organization. Could be part of About the role.
- "Work you'll do This role is responsible for providing penetration testing services through a combination of technology and manual ingenuity as part of the Global cyber services organization for member firms." That's About the role.
- Then responsibilities list.
- Then "Professionals currently in a Deloitte Global role may be considered for this position, regardless of their US location." That's eligibility note; could be About the role or Requirements? Probably About the role.
- Then "The team Deloitte Technology works at the forefront..." That's About the role/team description.
- Then "Qualifications Required:" list.
- Then "Preferred:" list.
- Then "Limited immigration sponsorship may be available." That's a note about sponsorship; could be Benefits? Not exactly; maybe we could put under About the role as a note. But we should not create Benefits section unless posting actually states them. It does mention limited immigration sponsorship may be available, which is a benefit/note. Could be placed under a Benefits section? The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. It does state "Limited immigration sponsorship may be available." That's a benefit/note about sponsorship. So we could create a Benefits section with that line. However, the instruction says "Prefer a few substantive sections over many thin ones." So maybe we can incorporate that note into About the role or Qualifications? It's not a qualification. Could be a note under About the role.
We need to decide.
Let's list all substantive info:
Company intro: Deloitte Global is the engine... (maybe keep)
Work you'll do: role responsible for providing penetration testing services through combination of technology and manual ingenuity as part of Global cyber services organization for member firms.
Responsibilities:
- Executing Penetration testing engagements:
- Web Application Penetration Testing
- Web Services / API Penetration Testing
- AI/LLM Penetration testing
- Network Penetration Testing
- Mobile Application Penetration Testing
- Thick Client Penetration Testing
- Providing consultative guidance to customers on findings identified in a clear and actionable fashion, both in writing and verbally
- Enhancing and updating testing methodologies, processes, and standards documentation
- Leveraging AI and LLM-based tools and prompt engineering, using both established platforms and emerging frameworks, to accelerate reconnaissance and generate or refine testing scripts
- Building, customizing, and maintaining AI-driven agents to automate recurring testing tasks
- Continuously validating the accuracy and reliability of self-developed AI tools, actively working to reduce hallucinations and false positives in vulnerability identification
- Evaluating and integrating emerging AI-assisted offensive security tooling into team methodology and playbooks
- Proficient at analyzing and understanding complex architecture designs.
- Ability to effectively communicate the services and capabilities our group can facilitate to our clients.
Additional note: Professionals currently in a Deloitte Global role may be considered for this position, regardless of their US location.
Team description: Deloitte Technology works at the forefront of technology development and processes to support and protect Deloitte around the world. In this truly global environment, we operate not in "what is" but rather "what can be" to help Deloitte deliver and connect with its clients, its communities, and one another in ways not previously conceived.
Qualifications Required:
- Experienced with Kali Linux or other dedicated Penetration Testing OS Platform.
- With knowledge of common testing tools like Burp Professional, AMASS, Metasploit, Postman, Swagger, NMAP, Qualys, SQL Map, and others
- Familiarity with OWASP Top 10 software security weaknesses and vulnerabilities
- Familiarity with various AI models and frameworks from providers such as Anthropic and OpenAI, and experience configuring tools like Obsidian and Ollama is a plus for supporting other workflows.
- Working knowledge of one scripting language and familiarity with at least one software programming language and framework
- Demonstrated experience working with diverse stakeholders, preferably on a global multi-national basis
- Ability to manage concurrent initiatives and use effective judgment in prioritization and time management
- Strong written and verbal communication skills
- Must be a US Citizen
Preferred:
- Certified Ethical Hacker (CEH) Certification
- Offensive Certified Security Professional (OSCP) Certification
- Any GIAC Certification (GSEC, GWAB, GPEN, GMOB, GCPN)
- OWASP Application Security Top 10
- OWASP API Security Top 10
- OWASP Thick Client Top 10
- OWASP LLM Top 10
- MITRE ATT&CK Framework
- Cloud Service testing
- Reverse Engineering
- Static Application Software Testing (SAST)
- Dynamic Application Testing (DAST)
- Experience of Agentic development and its application to support penetration testing
- Limited immigration sponsorship may be available.
Note: The last bullet under Preferred includes immigration sponsorship note; but it's actually a separate note after Preferred list? In the text: "Limited immigration sponsorship may be available." appears after the Preferred list, maybe as its own line.
We need to decide sections.
We have About the role: could combine company intro, work you'll do, team description, eligibility note.
Responsibilities: list as above.
Qualifications: combine Required and Preferred? Or separate? The instruction says use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid having both Requirements and Qualifications. But we need to decide if we have content for Requirements. The posting has "Qualifications Required:" and "Preferred:" but not a separate "Requirements" section. Could treat "Qualifications Required" as Requirements. Or we could have Requirements section for mandatory qualifications, and Qualifications section for preferred? But that seems redundant. Better to have one Qualifications section containing both required and preferred, maybe with subheadings? But we cannot add extra headings beyond the allowed list. However we could use
to note "Required:" and "Preferred:" inside the Qualifications section. Similarly Skills: we could extract skills like "Ability to effectively communicate...", "Proficient at analyzing...", "Ability to manage concurrent initiatives...", "Strong written and verbal communication skills", "Working knowledge of one scripting language...", "Familiarity with at least one software programming language and framework", "Demonstrated experience working with diverse stakeholders...". Those are already in Qualifications Required list. So maybe we don't need a separate Skills section; we can put those under Qualifications. But the instruction says we can have Skills section if there is real specific content. The posting does mention skills explicitly: "Ability to effectively communicate the services and capabilities our group can facilitate to our clients." "Proficient at analyzing and understanding complex architecture designs." "Ability to manage concurrent initiatives and use effective judgment in prioritization and time management." "Strong written and verbal communication skills." "Working knowledge of one scripting language and familiarity with at least one software programming language and framework." "Demonstrated experience working with diverse stakeholders, preferably on a global multi-national basis." Those are skills. So we could create a Skills section with those items. But we must not duplicate content. If we put them in Skills, we should not also put them in Qualifications. However the Qualifications Required list includes many of those as items. So we need to decide where to place them. The posting lumps them under Qualifications Required. So maybe we keep them under Qualifications Required. Then we don't need a separate Skills section. That would avoid duplication. Thus sections: About the role, Responsibilities, Qualifications (covers Required and Preferred). Possibly Benefits? The immigration sponsorship note could be placed under Benefits if we want a Benefits section. But the posting includes it under Preferred list (maybe as a bullet). Actually it's after Preferred list, but could be considered a benefit. However the instruction says never create Benefits section unless posting actually states them. It does state "Limited immigration sponsorship may be available." That's a benefit/note. So we could create a Benefits section with that line. But we already have a Preferred list that includes many certifications etc. The immigration sponsorship note is not a certification; it's a note about sponsorship. Could be placed under Benefits. But we need to avoid thin sections. A Benefits section with just one line might be thin. However it's substantive info. The instruction says prefer a few substantive sections over many thin ones. So maybe we incorporate that note into About the role or Qualifications as a note. It's not a qualification but could be a note about eligibility/sponsorship. Could go under About the role as a note: "Limited immigration sponsorship may be available." Thus we avoid creating a Benefits section. Now we need to output HTML fragment only, no /, no markdown. We'll produce:
About the role
... paragraphs ...
ThenResponsibilities
- ... each responsibility ...
Qualifications
Required:
- ... required items ...
Preferred:
- ... preferred items ...