Pentester \ MA Analyst

We're hiring a technical security professional to work across two connected disciplines: penetration testing our portfolio companies' applications and infrastructure, and M&A Technical Due Diligence on acquisition targets for a private equity firm. 

Your first 2-3 months are dedicated to M&A Technical Due Diligence: learning our existing scan and analysis process, running it on real or recent deals, and taking technical ownership of how it's done - including evaluating new tools and improving methodology over time. You'll have a Project Manager handling client coordination and report delivery throughout, the same way our pentest engagements work today - your job is the technical analysis and findings, not managing the client relationship.

After that, your time splits. Most weeks you'll run penetration tests for our portfolio companies. M&A due diligence work is driven by live deal activity, not a calendar - Divoro supports roughly 10-12 engagements a year, unevenly spaced, so some months bring several deals back-to-back and others bring none. When a deal is active, it takes priority over the pentest queue - the rest of the team covers you.

Responsibilities:

Penetration Testing

• Conduct black-box, gray-box penetration tests against web applications, APIs, and network/infrastructure environments
• Identify, exploit, and document vulnerabilities (OWASP Top 10, CIS benchmarks, common infrastructure misconfigurations)
• Write clear, actionable findings reports with risk ratings per CVSS calculator and remediation guidance

• Retest fixes and validate remediation effectiveness

   

M&A Analyst (Static Analysis)

• Run Divoro's M&A Technical Due Diligence scans and analysis on acquisition targets, using tools such as Snyk (OSS/license risk), SonarQube (code quality, technical debt, complexity), and Claude-assisted code analysis — not limited to these; evaluate and propose new tools as the practice's needs evolve
• Assess code quality, technical debt, complexity, and engineering team signals, and document clear, well-supported findings — the same standard as a pentest report
• Join deal-context intake calls and, when needed, help present findings to deal teams — coordinated by our Project Manager, who owns client communication and report delivery

• Take technical ownership of how the practice evolves — recommend and validate methodology and tooling improvements, with input from the wider team

   

Requirements (MUST HAVE):

• 3-4 years of experience in penetration testing
• Strong knowledge of web application and network/infrastructure testing methodologies
• Strong understanding of the software product development cycle and product architecture, sufficient to interpret M&A scan findings independently
• Experience with static analysis tools (e.g., SonarQube, Snyk, Checkmarx)
• Solid understanding of common vulnerability classes and secure coding practices
• Ability to communicate technical risk clearly 
• Comfortable working under confidentiality constraints and deal timelines