Ethical Hacker​/Penetration Tester Principal

sdna global is hiring a Java application security lead to strengthen products through real-world testing, clear remediation guidance, and incident support. This Ethical Hacker/Penetration Tester Principal role is hybrid in Albany, NY
, with travel to Albany twice per month
. You will help teams reduce risk across the SDLC by combining hands-on penetration testing with secure coding and vulnerability response.

• Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure.
• Find weaknesses in Java code using automated and manual techniques.
• Build and use custom exploits to validate application security and simulate attacker tactics.
• Partner with Development teams to understand application architecture and surface security gaps early.
• Work with Testing teams to integrate security checks into both manual and automation testing
  .
• Provide secure coding guidance
  , including how to fix vulnerabilities.
• Stay current on Java security threats and best practices
  , and help strengthen secure development processes (SDLC).
• Support security incidents tied to Java vulnerabilities
  , including issues aligned to current published NIST CVE
  .
• Document and report findings with technical details
  , risk assessment
  , and recommended solutions
  .
• Communicate recommendations to technical and non-technical audiences.
• Contribute to security policies covering Java development and deployment
  .
• Explore penetration avenues by manipulating URLs
  , query parameters
  , and application browser data
  .
• Validate and assess browser tokens
  , including cache manipulation
  , and evaluate production vs non-production architecture
  .
• Apply MITRE ATT&CK Framework familiarity in testing and validation work.

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 6+ years in a Development and/or Security (Dev Sec) role.
• Strong core Java coding experience and knowledge of Java security practices.
• Experience in Penetration Testing and/or Ethical Hacking with a focus on Java application security
  .
• Background as an engineer and in Dev Sec work on a large-scale public enterprise application
  .
• Scripting experience and strong problem-solving and analytical skills.
• Web application security principles (including OWASP
  ) and knowledge of common vulnerabilities such as SQL injection and XSS
  .
• Penetration testing tooling experience, including Burp Suite and Metasploit
  .
• Familiarity with Fortify on Demand (SAST and DAST tools).
• Strong understanding of cryptography and secure communication protocols such as SSL/TLS
  .
• Excellent communication skills and the ability to maintain confidentiality with high ethical standards.

• Java
  , Burp Suite
  , Metasploit
• Fortify on Demand
  , OWASP
• SQL injection
  , XSS
• SSL/TLS
  , MITRE ATT&CK Framework
  , NIST CVE

• Security certifications such as OSCP
  , GWAPT
  , GXPN
  , GPEN
  , LPT
  , CEH
  , CISSP
  , or other industry security certifications.
• Experience with scripting languages such as Python and Bash
  .
• Experience with secure code review for Java
  .
• Familiarity with cloud security testing
  .
• Experience with mobile application penetration testing
  .
• Knowledge of regulations such as HIPAA
  .
• Experience with API testing
  .

Compensation: USD 55-60 per hour.