Penetration Tester

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Penetration Tester based in the United States.

Using industry-leading tools and frameworks, you will help development teams address security risks and implement robust security practices. You will also contribute to integrating automated security testing into Dev Ops and CI/CD pipelines. This is an opportunity to make a meaningful impact on application security in a mission-critical federal environment.

• Collaborate with development teams and stakeholders to identify, define, and translate security requirements into practical application security measures.
• Establish, maintain, and promote application security best practices, ensuring alignment with recognized industry standards.
• Assess the security of third-party libraries, software components, and dependencies to identify potential risks.
• Conduct manual and automated secure code reviews of Java and Scala applications, identifying vulnerabilities such as Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL injection, and privilege escalation, and recommending appropriate remediation strategies.
• Analyze and interpret findings from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools, providing actionable recommendations across different applications, languages, and platforms.
• Perform static, dynamic, and manual penetration testing of web applications and REST APIs, primarily using Burp Suite.
• Review software security architecture and application designs to identify weaknesses and recommend improvements.
• Prepare comprehensive security assessment reports documenting vulnerabilities, findings, risk levels, test outcomes, and remediation recommendations.
• Demonstrate identified vulnerabilities to application owners and guide technical teams toward effective security remediation.
• Develop scripts and integrate security tools into Dev Ops and CI/CD pipelines to automate application security testing and improve development workflows.

• At least 3 years of practical experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• 3+ years of hands-on experience conducting manual penetration testing of web applications and REST APIs using Burp Suite Professional and tools such as Postman or Bruno.
• Strong understanding of secure coding practices, application security principles, and Dev Sec Ops  methodologies.
• In-depth knowledge of the OWASP Top 10 and SANS Top 25, including their associated security risks and testing guidelines.
• Familiarity with CI/CD processes, AWS security principles, Jenkins, and Git Hub.
• Ability to analyze complex security findings, communicate technical risks clearly, and provide practical remediation guidance to development teams and stakeholders.
• Strong analytical, problem-solving, communication, and technical documentation skills.
• Must be a U.S. citizen and able to successfully pass a federal background investigation to obtain access to sensitive information.
• Preferred certifications include GPEN, GWAPT, OSCP, or CompTIA Pen Test+.
• Full-time, fully remote work arrangement within the United States.
• Opportunity to contribute to application security initiatives within a federal healthcare program.
• Hands-on experience with industry-standard penetration testing tools, security frameworks, and Dev Sec Ops  technologies.
• Opportunity to collaborate with development, security, and technical stakeholders on meaningful cybersecurity challenges.
• Exposure to enterprise application security, vulnerability management, and automated security testing practices.