Ethical Hacker​/Penetration Tester Principal

MKS2 Technologies is seeking an Ethical Hacker / Penetration Tester Principal to help secure a large-scale enterprise application environment. The role focuses on identifying, exploiting, assessing, and remediating vulnerabilities in Java-based applications and supporting infrastructure, in partnership with teams across the SDLC and Dev Sec Ops  lifecycle.

• Location: New York, NY (Hybrid)
• Work pattern: Remote with travel to Albany, NY twice per month (two trips per month)
• Job Type: Full-Time
• Program: NYSoH
• Hours: 40 hours per week

• Compensation: USD 120,000 per year

• Perform penetration testing and vulnerability assessments for Java applications, APIs, and supporting infrastructure.
• Execute manual and automated security testing to uncover application vulnerabilities.
• Develop and run custom exploits to model real-world attacker behaviors.
• Review application architecture and source code to identify security risks and likely attack vectors.
• Collaborate with development teams to integrate security earlier in the SDLC
  .
• Work with QA and automation teams to incorporate security testing into release processes.
• Review source code and provide guidance aligned with secure remediation practices.
• Assess browser tokens, session management, caching, and authentication mechanisms.
• Test exploitation opportunities by manipulating URLs, query parameters, browser data, and application workflows.
• Support incident response activities related to security vulnerabilities and published CVE information.
• Create detailed reports covering findings, risk levels, business impact, and remediation recommendations.
• Deliver security findings to both technical and non-technical stakeholders.
• Contribute to security standards, policies, and secure development practices.
• Stay current on emerging threats, attack techniques, and industry best practices.
• Use methodologies aligned with MITRE ATT&CK and OWASP guidelines.

• Education: Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field
• Experience: Minimum of 6 years of software development and security experience
• Prior experience in a Dev Sec Ops , Application Security, Security Engineering, or Penetration Testing role
• Strong hands-on Java development experience
• Experience supporting large-scale enterprise applications
• Knowledge of secure coding principles and application security best practices
• Experience performing penetration testing against web applications and services
• Strong understanding of OWASP Top 10 vulnerabilities and mitigation techniques
• Experience using security testing tools, including:
  Burp Suite
  , Metasploit
  , web proxy tools, and vulnerability assessment platforms
• Experience with Static and Dynamic Application Security Testing (SAST/DAST), including:
  Fortify on Demand (SAST) and Fortify on Demand (DAST)
• Knowledge of web vulnerabilities such as SQL Injection
  , Cross-Site Scripting (XSS),
  Authentication & Authorization Flaws
  , Session Management Vulnerabilities
  , and API Security Risks
• Strong understanding of cryptography and secure communications protocols (
  SSL/TLS
  )
• Excellent analytical, troubleshooting, and problem-solving skills
• Strong written and verbal communication abilities
• Demonstrated professionalism, ethics, and confidentiality

• OSCP (Offensive Security Certified Professional)
• GWAPT (GIAC Web Application Penetration Tester)
• GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
• GPEN (GIAC Penetration Tester)
• LPT (Licensed Penetration Tester)
• CEH (Certified Ethical Hacker)
• CISSP (Certified Information Systems Security Professional)
• Experience with Python
  , Bash
  , or other scripting languages
• Experience performing secure code reviews for Java…