Application Security Pentester, Specialist

Leads and executes security assessments to identify, validate, and communicate security risks. Performs manual and automated penetration testing, conducts additional security assessments such as Secure Code Reviews and Dynamic Application Security Testing (DAST), and produces clear, actional reports for technical teams and leadership. Partners with IT and business stakeholders to assess risk, support remediation, and improve the organization’s overall security posture.

• Leads and executes penetration tests across a variety of technologies, including web applications, APIs, and AI-enabled systems. Performs manual and automated testing to identify, exploit, and validate vulnerabilities.

• Conducts other security assessments as needed, including Secure Code Reviews and/or Dynamic Application Security Testing (DAST).

• Develops detailed assessment reports and presents findings to technical teams and leadership. Coordinates security risk reporting and collaborates with IT sub-divisions, third-party partners, and business units to identify the impact of technology implementations on IT and business operations.

• Contributes to the evolution of team processes, testing methodologies, standards, and best practices.

• Maintains subject‑matter expertise in common vulnerability classes and attack techniques (e.g., OWASP Top 10, OWASP Top 10 API, SANS Top 25), and remains familiar with relevant security frameworks (e.g., MITRE ATT&CK). Stays current on emerging threats, tools, and offensive security techniques.

• Participates in special projects and performs other duties as assigned.

• Minimum five years related work experience with three years experience in IT security or application development.

• Undergraduate degree in related field or equivalent combination of training and experience.

• Hands‑on experience performing web application, API, and network penetration testing.

• Preferred experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tooling.

• Experience in on or more of the following a plus: cloud penetration testing, mobile penetration testing, AI red teaming

• Proficiency in at least one programming or scripting language (e.g., Python, Java).

• Preferred security certifications such as Off Sec Certified Professional (OSCP), Off Sec Web Assessor (OSWA), Off Sec Web Expert (OSWE), GIAC Penetration Tester (GPEN), or GIAC Web Application Penetration Tester (GWAPT).

Vanguard is not offering visa sponsorship for this position.