Delivery Senior Consultant, Penetration Tester

Deloitte’s Delivery Senior Consultant, Penetration Tester role places you at the core of practical security testing within the firm’s Cyber Defense & Resilience group. Based in Charlotte, NC with a hybrid work arrangement, you’ll perform thorough assessments of web applications and APIs, translate findings into remediation guidance, and collaborate with a range of technical teams to strengthen client defenses. This position sits within Deloitte’s US Delivery Center model, combining the reach of a global firm with a focused, service-driven delivery footprint.

Responsibilities

• Conduct both manual and automated penetration tests of web applications, APIs, and supporting infrastructure.
• Identify, validate, and document security vulnerabilities including items in the OWASP Top 10.
• Perform authenticated and unauthenticated testing across development, test, and production-like environments.
• Evaluate application security controls such as authentication, authorization, session management, input validation, and encryption.
• Produce clear, risk-based reports detailing technical findings, business impact, proofs of concept, and remediation recommendations.
• Collaborate with developers, architects, and security teams to communicate findings and support remediation efforts.
• Retest remediated issues to confirm closure.
• Contribute to security standards, testing methodologies, and internal knowledge sharing.
• Remain current on emerging threats, exploit techniques, and application security trends.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
• Ability to obtain and maintain the necessary clearance for the role.
• Certifications: OSCP, OSWE, GPEN, or CEH.
• Minimum 2+ years of hands-on web application focused penetration testing experience.
• Strong understanding of web technologies including HTTP/S, REST APIs, JavaScript, cookies, headers, and sessions.
• Experience identifying vulnerabilities such as SQL injection, XSS, CSRF, SSRF, IDOR, authentication flaws, and access control weaknesses.
• Proficiency with testing tools such as Burp Suite, OWASP ZAP, Nmap, Postman, and related tools.
• Experience writing professional penetration test reports for technical and non-technical audiences.
• Familiarity with OWASP Top 10, CWE, CVSS, and secure coding principles.
• Hybrid Work Model: residence within commutable distance to one of the US Delivery Center locations (Gilbert, Lake Mary, Mechanicsburg) or Geo-Hub locations (Atlanta, Charlotte, Dallas, Houston, Philadelphia).
• Co-location Expectation: up to 30% of working time spent co-located at an assigned office for projects, trainings, and related activities at Deloitte Delivery Center locations, Geo-Hub locations, approved sites, or project locations.
• Travel Requirement: up to 10% overnight travel for client or project purposes.
• Relocation: if needed, relocation should be completed within 12 weeks from start date to reside within commutable distance.
• Must be legally authorized to work in the United States without employer sponsorship now or in the future.

Technologies

• Burp Suite
• OWASP ZAP
• Nmap
• Postman
• JavaScript

The Team

Deloitte’s Government & Public Services (GPS) practice delivers impact for federal, state, and local government clients as well as public higher education institutions. The Cyber Defense & Resilience offering helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence, while managing dynamic attack surfaces and enabling rapid crisis and cyber incident response. This opportunity resides in the Deloitte US Delivery Center model, a delivery-focused framework that leverages scale and talent with standardized processes to provide high-quality, cost-effective services to clients. The US Delivery Center combines a small-business feel with the resources of Deloitte, offering professionals opportunities to work at dedicated delivery locations with limited travel requirements.