Rhino offers a range of deep-dive pentest services, from web/mobile apps to networks, social engineering, and AWS and cloud environments.
These services — and the security research that drives it — are performed by the Assessments (pentest) Team. 

Pentest Role Specialization

For the Assessments Team, developing expertise in each of these areas requires specialization on an individual level.  No one’s an expert in everything, and complementary strengths make us stronger as a team.

Core Pentesters have assessments primarily focused on application pentesting (web/mobile), and network pentesting and social engineering based on individual preference.  While these are often familiar technologies to most pentesters, deeper specialization is also expected — some Core Pentesters are experts in attacking mobile applications, where others have a background in AD exploitation.

Seniority and Leveling Structure

All Contributor Roles at Rhino have 4 levels to establish seniority and expertise:  (1) Associate, (2) Career, (3) Senior, and (4) Principal.  Responsibilities and expectations are clearly defined at each level, as well as salary and compensation ranges as expertise grows.  

As a preview of that structure, below is the summary of Rhino’s Pentest role/level structure:

Assessment Team Benefits

Here are the benefits offered to all pentesters – 

• Fully-Covered Health Insurance (Medical, Dental, Vision)
  Rhino Security Labs provides medical, dental and vision insurance coverage to all employees (100% free – no monthly premiums!)
• Generous Quarterly Bonus structure
  All FTEs are offered quarterly performance bonuses, from 1.25% – 3.75% of salary per quarter (5-15% over the year), based on individual and company performance.
  Example:  An FTE with an annual salary of $100,000 hits all of their quarterly goals, and the company hits its quarterly revenue goals.  Their Quarterly bonus would be $3,750.
• Assessment Research Program / R&D Bonus
  Technical security research is very important to Rhino;  To actively support vital research, we offer a $3,000 R&D Bonus for each completed research project + blog post.
• Assessment Training and Education Stipend
  Staying up to date with technological changes is key to Rhino’s competitive advantage in our pentest offerings. In addition to General Training opportunities, each penetration tester has an annual stipend of $2,500 to spend on any professional training or research they wish.
• 401k w/Company Matching
• 9 Vacation Days + 3-Weeks PTO/Sick Leave
• No Required Travel
  Oftentimes pentest consulting roles require heavy travel to client sites (upwards of 75%).  At Rhino, we have very few projects at client sites, and we never require travel for anyone who doesn’t want it.

What we look for in Pentesters

When it comes to pentesters, we’re always hiring!  However, what we’re looking for depends on the role.  

For Core Pentesters, web pentest experience is the most critical technical skill.  We perform a lot of web/mobile/API pentesting, and so the stronger the knowledge in performing these attacks, the better.

Bridging Skill Gaps

Core Pentesters – Webapp Pentester Roadmap

Academic Knowledge
For “Academic Knowledge”, we recommend the Webapp Hackers Handbook (v2) to start. It’s a great book for learning appsec and while it’s very thorough, it starts from the beginning (chapter 1 is a review of HTTP and web concepts).

Hands-On (Sandbox) Experience
Just reading from a book will only take you so far. You’ll need a hands-on lab environment where you can test out the concepts you’re learning in WAHH. 

The labs from Web Security Academy are what we’d recommend here, which have several exercises for each vulnerability category (XSS, SQLi, Authentication bugs, etc).  WSA also has the benefit of tracking your progress throughout the labs, giving you a ‘scoreboard’ of progress to share in interviews.

Tools
Once you have the book and labs, you’ll need to get relevant tools. While it’s a common route to download Kali Linux and try dozens of tools, we recommend starting by downloading Burpsuite (Community) and getting very familiar with that.  Burp is the ‘swiss army knife’ of webapp pentesting and will be the one tool you’ll use every day.

Real-World Experience
You could spend weeks or months just going through these tools (and it would take you a long way!) but real-world experience is often where budding pentesters struggle in getting their foot in the door.

When you start getting comfortable with the above, sign up for bug bounties (HackerOne.com and bugcrowd.com) and try finding vulnerabilities in real-world applications. Start off with smaller/newer bounties which don’t offer financial rewards — there will be many fewer eyes on those programs, and give you a better chance at early wins demonstrating your experience in the real world.

As you start building your bug collection, add your HackerOne/BugCrowd profiles to your resume and mention the bugs you’ve found in the relevant section.  

Even a few of these real vulnerabilities will be a gold star as you break into the industry — at Rhino, we’ve hired several Associate pentesters from this same training path!