Jnr-Mid Penetration Tester (South Sudan | Juba)

Location: Juba South Sudan. On-site.
You must already live in Juba and hold the right to work in South Sudan. This role cannot be done remotely and no relocation is offered.

Employment type: Contract 1 year initially - expected to renew annually.
Seniority: Junior to mid-level.

• You will be our clients presence in Juba delivering on-the-ground penetration testing for their South African offensive security team.
• You are the only member of that team in the country so alongside the testing you own the on-site infrastructure that gives the wider team access to client networks.
• One-year contract to start expected to run for around three years with your employment handled locally through an employer of record.

RedHerd is a specialist cybersecurity recruitment and advisory firm. We work with consultancies product companies vendors and enterprise security teams across South Africa the UK Europe and the United States.
We are deliberately low volume. Clients come to us when a role is niche senior sensitive or business-critical.
We are recruiting this position exclusively on behalf of our client. We share their identity with you during qualification before submitting anything. We never introduce your profile without your knowledge and consent.

Our client is one of the largest cybersecurity consultancies in the world operating across Europe Africa and the Middle East. Their offensive security practice is delivered out of South Africa by a team with a long-standing international reputation for technical depth and published research.

This is a hands-on penetration testing role based in Juba South Sudan. You will deliver assessments across web applications infrastructure internal and external networks and Active Directory and you will write the reports that go to the client.

This is not a desk role and it is not a governance audit or compliance position. It is not a physical or personnel security role. It is a technical seat on-site in a live client environment.

• Perform manual penetration testing across web applications infrastructure and internal and external networks.
• Test Active Directory environments from initial access through privilege escalation.
• Identify validate and exploit vulnerabilities going beyond automated scanner output.
• Produce high-quality technical reports with clear risk ratings and practical remediation guidance.
• Present findings to technical and business stakeholders and support remediation discussions.
• Install configure and maintain the on-site testing appliance and its connectivity back to the testing teams infrastructure.
• Act as the local technical contact for the remote testing team throughout an engagement.
• Troubleshoot network connectivity and access problems on site and resolve them quickly.
• Carry out on-site testing activity including wireless assessment and physical access testing where the engagement calls for it.
• Work with the end clients own IT and security staff to arrange access scheduling and logistics.

• You already live in Juba and hold the right to work in South Sudan.
• Hands-on penetration testing experience roughly two to six years. We judge scope and depth over the number.
• Demonstrable experience across web application infrastructure and network penetration testing and a working Active Directory methodology.
• Evidence of manual testing and exploitation not scanner output alone.
• Working proficiency with Burp Suite Kali Linux Metasploit Nmap Nessus and Wireshark and the ability to explain what you used each one for.
• Scripting in Python Bash or PowerShell.
• A solid understanding of the OWASP Top 10 modern attack methodologies and common enterprise technologies.
• Report writing you can stand behind. The work is report-driven and your reports go to the client.
• A degree in computer science information technology cybersecurity or a related field.
• At least one recognised penetration testing certification for example OSCP PNPT CRTP CRTE eCPPT eJPT CPTS CEH or CompTIA Security.
• Working knowledge of networking and infrastructure: routing and switching firewalls VPNs and diagnosing connectivity faults on real equipment rather than in theory.
• Clear spoken and written English and the ability to answer a technical question directly. You will work daily with a team in another country over video and email and this matters more here than in an office role.
• Reliability. You are the only person the team has in the country.

• Cloud assessment experience across AWS Azure or GCP.
• API security testing.
• Experience with BloodHound Impacket CrackMapExec or NetExec.
• Experience administering Windows or Linux servers including patching and basic hardening.
• Experience inside a bank telecommunications operator regulator or other security-sensitive organisation.
• Vulnerability scanning and patch management experience.
• Incident response or digital forensics exposure.
• Wireless testing experience.
• Any public evidence of your own work: write-ups tooling capture-the-flag results video or an active platform profile.

On-site in Juba at the end clients location with travel within the city as engagements require.

Your contract runs for one year initially and is expected to renew annually.

Because our client does not have a legal entity in South Sudan a local employer of record administers your employment. That company handles your contract your payment and your local tax deductions. You work for our client. They pay the cost of that arrangement; it is never deducted from you and we explain it fully before anything is signed.

We will discuss the package during the Clearing Call with RedHerd.

1. Apply on the job page. Submit a CV and answer all the screening questions.
2. Clearing call with RedHerd to discuss your application and the role. The client is named to you here.
3. With your consent RedHerd submits your profile to the client.
4. Interview with the clients team.
5. Technical assessment. This is practical and you will be asked to write up what you did.
6. Background and reference checks then contracting through the employer of record.

If a profile or CV does not fully describe confidential work candidates are encouraged to explain their contribution without disclosing sensitive customer or employer information.

• You work directly with an internationally recognised offensive security team rather than adjacent to one.
• The engagement is long-term not a single project: one year to start and expected to run for around three.
• The work is technical and hands-on from day one on live client infrastructure.
• You cover the full range of testing rather than one narrow specialism.
• Your employment tax and payment are handled properly and locally through an established arrangement.

Applications are considered against the skills experience location and verification requirements of the role. RedHerd and our clients are committed to a fair and respectful process and do not discriminate on the basis of any protected characteristic.