Penetration Tester Resume Example (2026 Guide)
Penetration Tester resume example
A complete sample in the Modern template FitMyRole exports. The person and employers are fictional; the structure, skills and bullet style are what to copy.
Mikhail Sokolov
[email protected] • (555) 019-3305 • Austin, TX • linkedin.com/in/mikhailsokolov
Professional Summary
Senior Penetration Tester with 7 years in information security, the last 5 spent on web application, API, internal network and Active Directory penetration testing for clients in finance, healthcare and SaaS. Has delivered 100+ engagements and reported 900+ vulnerabilities, 60 of them rated critical, each with a reproducible proof of concept and remediation steps developers can act on. Holds OSCP and OSWE, and writes Python tooling for the business logic and authorization flaws that scanners miss. Scopes work directly with client security leads, writes reports for both executives and engineers, and mentors three junior testers.
Technical Skills
- Penetration Testing: Web app testing, API testing, internal and external network pentests, Active Directory, cloud configuration review, wireless, social engineering, retesting
- Offensive Tools: Burp Suite Professional, Metasploit, Nmap, BloodHound, Impacket, Responder, NetExec, Certipy, sqlmap, ffuf
- Methodologies & Standards: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, PTES, MITRE ATT&CK, CVSS v3.1, PCI DSS 11.4
- Cloud & Platforms: AWS IAM, Microsoft Entra ID, Kubernetes, Docker, Linux, Windows Server, Active Directory Certificate Services
- Scripting & Development: Python, Bash, PowerShell, JavaScript, Go, Burp Suite extensions
- Reporting & Delivery: Executive summaries, technical findings with proof of concept, remediation guidance, scoping and rules of engagement, client readouts
Education & Certification
- Minor in Cybersecurity; captain of the university capture-the-flag team, placing in the top 20 at two national competitions.
- White-box web application testing: source code review, authentication bypass and chained exploits.
Work Experience
Senior Penetration TesterApril 2023 – PresentIronvale Security Partners, Austin, TX
- Delivered 45 web application, API and internal network penetration tests on schedule, scoping each with client security leads and agreeing rules of engagement before testing began.
- Found a broken object level authorization flaw in a payments client’s API that exposed 2.3 million customer records, reported it with a working proof of concept the same day and confirmed the fix on retest.
- Reached domain admin in 19 of 24 internal Active Directory assessments by chaining LLMNR poisoning, Kerberoasting and misconfigured certificate templates mapped with BloodHound and Certipy.
- Raised client remediation of critical and high findings to 92% within 90 days by adding developer-ready fix steps and code samples to every report and holding a readout with engineers.
- Built a Python tool that tests multi-tenant APIs for authorization flaws, now run on every API engagement and credited with 30+ findings.
- Rewrote the firm’s web testing checklist around OWASP ASVS Level 2, cutting report QA rework from two review rounds to one.
- Mentor three junior testers through paired testing and report reviews; two passed OSCP within their first year.
Penetration TesterMarch 2021 – March 2023Redline Assurance Group, Dallas, TX
- Completed 60+ external, internal and web application penetration tests for mid-market banks, hospitals and retailers, many to meet PCI DSS 11.4 requirements.
- Reported 400+ vulnerabilities with CVSS scores and proof of concept, including SQL injection, stored XSS, SSRF and default credentials on network devices.
- Ran phishing and vishing campaigns for 12 clients, capturing credentials in 9 and turning the results into targeted awareness training.
- Automated recon and Nmap output parsing in Python, cutting setup time for external tests from a full day to about two hours.
- Performed retests on every engagement and wrote attestation letters that clients submitted to their auditors.
Vulnerability AnalystJune 2019 – February 2021Pecan Grove Health System, San Antonio, TX
- Cut open critical vulnerabilities from 310 to 45 in one year by running Nessus and Qualys scans across 4,000 hospital assets and working each finding with IT owners.
- Tested internal web apps with Burp Suite before release, finding 25 issues including an IDOR in the patient portal that was fixed before launch.
- Coordinated scope, access and retesting for the health system’s first third-party network penetration test.
- Wrote the vulnerability management standard with risk-based patch timelines, adopted by IT leadership in 2020.
Want yours to read like this? Upload your resume and a job posting, and FitMyRole rewrites it for that job in this template.
Tailor my resumeWhy This Resume Works
- Engagement and finding counts appear up front (100+ engagements, 900+ vulnerabilities, 60 critical), which is how pentest managers size a candidate.
- OSCP, OSWE and the Burp Suite Certified Practitioner credential are dated in their own section, so the certification filter most pentest postings use is met immediately.
- Bullets name the attack chain, not just the outcome: "chaining LLMNR poisoning, Kerberoasting and misconfigured certificate templates mapped with BloodHound and Certipy."
- Reporting is treated as a deliverable with a measured result: client remediation of critical and high findings raised to 92% within 90 days.
- The progression from vulnerability analyst to penetration tester to senior shows how the offensive skills were built, and the mentoring bullet supports the senior title.
Common Resume Mistakes
- No engagement or finding metrics.
- Missing OSCP or tool keywords.
- Vague "tested security" without type or output.
Keywords Recruiters Look For
- Penetration testing
- Pentest
- OSCP
- Burp
- Metasploit
- Vulnerability
- Web app
- Reporting
Get more interviews. Tailor your resume automatically
Want to tailor your resume to the job you want? Use FitMyRole to analyze your resume and rewrite it for the role. Before sending your next application, run your resume through FitMyRole to tailor it to the job description.
Try FitMyRole free