Senior Specialist, Web Application Penetration Tester

Senior Specialist, Web Application Penetration Tester – KPMG US

We are seeking an experienced penetration tester to join our Managed Services practice and help secure web and API applications. The role focuses on manual testing, threat modeling, and delivering findings to stakeholders.

• Conduct manual application penetration testing against APIs (REST/SOAP), web applications, mobile applications, and thick client applications.
• Perform objective‑based penetration testing engagements.
• Execute threat modeling, evaluate application business logic, and conduct application architecture reviews.
• Demonstrate application testing skills through real‑time demos to internal and external audiences.
• Operate independently with minimal supervision.
• Act with integrity, professionalism, and personal responsibility, upholding KPMG’s respectful and courteous work environment.

• Minimum three years of recent experience in application penetration testing of APIs, web applications, or mobile applications.
• Bachelor’s degree from an accredited college/university or equivalent industry experience.
• Ability to communicate testing results to technical and non‑technical audiences and lead remediation discussions.
• Experience with Burp Suite Pro and other application testing tools such as Netsparker and Checkmarx.
• Preferred ethical hacking certifications (e.g., GIAC Web Application Penetration Tester, CREST, OSWE, OSWA).
• Ability to travel as required.
• Must be authorized to work in the U.S. without the need for visa sponsorship.

KPMG offers a comprehensive benefits package including medical, dental, vision, disability, and life insurance, 401(k), and personal well‑being benefits. Salary ranges for this role in the Los Angeles area are $99,461.00–$.

KPMG is an equal‑opportunity employer. We comply with all federal, state, and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, citizenship status, disability, protected veteran status, or any other protected category.