Penetration Tester
Primary stack
Job description
About the Position
Penetration Tester
We are seeking a Senior Penetration Tester with extensive experience in offensive security to join our team in Poland, conducting controlled attacks to identify vulnerabilities.
Responsibilities
Senior pentester combines technical testing with business communication - they must not only find vulnerabilities but also explain their impact to management. Key responsibilities include:
- Planning and conducting penetration tests of web applications, mobile apps, and APIs (OWASP Top 10, OWASP ASVS)
- Network infrastructure testing: scanning, enumeration, privilege escalation, lateral movement
- Conducting red team campaigns and APT simulations with social engineering and phishing techniques
- Testing Active Directory, cloud environments (AWS/Azure/GCP), and container environments (Kubernetes, Docker)
- Creating custom exploits and automation scripts in Python, Bash, or PowerShell
- Preparing technical and executive summary reports with risk assessment according to CVSS 3.1
- Retesting and verifying the effectiveness of implemented security patches
- Supporting development teams in secure code review and threat modeling
- Ensuring test compliance with PTES, OSSTMM methodologies and NIS2/DORA requirements
- Mentoring juniors and participating in bug bounty and responsible disclosure programs
Requirements
Senior penetration tester combines deep technical knowledge with industry certifications and a minimum of 4-5 years of offensive practice. The following table presents the competency profile expected by employers in 2026:
| Competency | Required Level | Details |
|---|---|---|
| Web/API pentesting | Expert | OWASP Top 10, Burp Suite Pro, SQLi, XSS, SSRF, deserialization |
| Network pentesting | Expert | Nmap, Metasploit, pivoting, privilege escalation Windows/Linux |
| Offensive certifications | Required OSCP | OSCP mandatory, OSEP, OSWE, CRTO, GPEN welcome |
| Scripts and automation | Advanced | Python, Bash, PowerShell - writing custom tools |
| Active Directory | Advanced | Kerberoasting, AD CS, BloodHound, Pass-the-Hash |
| Cloud security | Intermediate | AWS/Azure/GCP misconfigurations, IAM, cloud testing |
| Red teaming | Advanced | C2 (Cobalt Strike, Sliver), evasion, MITRE ATT&CK |
| Reporting | Expert | Technical and business reports, CVSS, communication with management |
| Knowledge of regulations | Good | NIS2, DORA, ISO 27001, GDPR in the context of testing |
| English language | B2/C1 | Documentation, contact with international clients |
Salary and Market Range 2026
A senior penetration tester in Poland earns 17,000–27,000 PLN gross/month on an employment contract, and on a B2B contract, rates reach 200–320 PLN/h. The range results from several factors:
- Location - Warsaw and remote work for foreign companies are 10-20% higher than Kraków or Wrocław
- Industry - the financial sector (DORA) and security consulting pay a premium over public administration
- Certifications - having OSEP, OSWE, or OSCE³ increases the range by 2,000–4,000 PLN
- Experience in red teaming and CVEs on record - the highest rates for those with publications and CTF achievements
- Niche specialization - ICS/OT, hardware, or automotive pentests are valued highest
The standard benefits package includes: an annual training budget of 8,000–15,000 PLN for certifications (OSCP, SANS), private healthcare, a sports card, flexible hours, full remote work, and access to Hack The Box labs and CTF platforms. Increasingly, companies also offer additional days off for attending conferences (Confidence, x33fcon) and bug bounty programs.
How Smartways.io Recruits a Penetration Tester
Recruitment of a penetration tester is based on actively reaching out to passive candidates and technical verification of their offensive skills. Our process looks like this:
- Needs analysis and profile calibration - we determine the scope of tests, required certifications, and tech stack (2-3 days)
- Direct search and headhunting - we reach out to pentesters from LinkedIn, CTF communities, and certified databases (5-7 days)
- Initial technical verification - screening of OSCP competencies, portfolio of reports, and experience in red teaming (3-5 days)
- Presentation of the shortlist - we provide 3-5 verified candidates with technical notes (2 days)
- Support in interviews and negotiations - we coordinate practical tasks (lab/CTF) and finalize the offer (5-7 days)
The entire process usually closes within 3-4 weeks from the brief to the signing of the contract. For roles with a narrow specialization (ICS/OT, hardware), the time may extend to 5 weeks due to the limited candidate pool.
FAQ – Common Questions about the Penetration Tester Position
How long does the recruitment of a penetration tester with Smartways.io take?
Standardly 3-4 weeks from the brief to the signing of the contract. We usually present the first shortlist of verified candidates within 10-12 working days.
Does a penetration tester need to have an OSCP certificate?
At the senior level, OSCP is practically a market standard and most employers treat it as a requirement. Additionally, OSEP, OSWE, CRTO, and SANS/GIAC (GPEN, GWAPT) certifications are valued.
How much does a senior penetration tester earn in Poland in 2026?
The range is 17,000–27,000 PLN gross/month on an employment contract, and on a B2B contract, hourly rates reach 200–320 PLN/h. The highest salaries are for red team specialists and ICS/OT pentests.
How does a pentester differ from a SOC specialist?
A pentester operates offensively - simulating attacks and looking for vulnerabilities, while a SOC analyst works defensively, monitoring and responding to incidents in real-time. These are complementary roles in a security team.
Can a penetration tester work remotely?
Yes, most application and infrastructure pentests are conducted remotely. On-site work mainly concerns physical tests, red teaming with social engineering, and ICS/OT environments requiring on-site presence.
What other security roles are worth recruiting alongside a pentester?
When building a mature security team, consider recruiting a tech lead coordinating architecture and a product owner responsible for prioritizing patches. For data-driven departments, a senior data scientist supporting anomaly analysis is also helpful.
Hire a Penetration Tester
Our specialists are ready to join your team.
Position: Penetration Tester
We can quickly send you good candidates. Contact us
SmartWays Sp. z o.o. - 2026 - all rights reserved.
© SmartWays Recruitment. This job description was sourced from the employer's public career page. TheJob is not the employer — we index the posting and route candidates to the source. All content rights and hiring decisions belong to the employer.
IT,Finance,Sales,Purchasing,Other industries
About the Company SmartWays Recruitment offers bespoke and scalable recruitment solutions tailored to the evolving needs of businesses across various industries. The company focuses on recruitment within EMEA markets but delivers projects globally. Their services include direct search, contracting, body leasing, executive search, recruitment process outsourcing, and HR on-demand services. Products, Services & Tech Stack Core Solutions: Direct Search Contracting Body Leasing Executive Search Recruitment Process Outsourcing HR on-demand Project Scope & Target Clients Client Base: IT Finance Sales Purchasing Other industries Engineering Scale: Projects for large corporations, small businesses, and start-ups.