Senior Application Penetration Tester

Plan and execute penetration tests across web, mobile (iOS & Android), API, cloud-native/containerized, and AI/LLM-integrated applications

Assess AI/ML and generative AI-powered features for risks such as prompt injection, insecure output handling, training data poisoning, model denial of service, and sensitive information disclosure, aligned to the OWASP Top 10 for LLM Applications and MITRE ATLASPartner with AI/ML engineering and data science teams to threat-model AI-powered features and embed security testing into MLOps and CI/CD pipelines

Evaluate cloud-native and containerized workloads (AWS, Azure, GCP, Docker, Kubernetes) and Infrastructure as Code for misconfigurations and weak security controls

Test modern API architectures (REST, GraphQL, gRPC), including OAuth2, OIDC, and JWT authentication and authorization flaws, and microservices-based applications

Conduct mobile application security testing and reverse engineering, including hardcoded credentials, insecure keychain storage, and anti-emulator/obfuscation bypass

Own the overall vulnerability remediation status of the global application portfolio, and serve as the primary point of contact for application teams on remediation matters

Manage application risk rating processes and ensure timely risk scoring of new and changing applications

Build and maintain dashboards and status reports for portfolio leads and CIOs, and follow up on overdue vulnerabilities to meet compliance timelines

Develop clear, actionable penetration test reports and communicate findings and remediation strategy to both technical and executive stakeholders

Research emerging attack techniques and tooling, and drive automation and process improvements across the testing program
Chubb is a world leader in insurance. With operations in 54 countries, Chubb provides commercial and personal property and casualty insurance, personal accident and supplemental health insurance, reinsurance, and life insurance to a diverse group of clients. The company is distinguished by its extensive product and service offerings, broad distribution capabilities, exceptional financial strength, underwriting excellence, superior claims handling expertise and local operations globally.

At Chubb, we are committed to equal employment opportunity and compliance with all laws and regulations pertaining to it. Our policy is to provide employment, training, compensation, promotion, and other conditions or opportunities of employment, without regard to race, color, religious creed, sex, gender, gender identity, gender expression, sexual orientation, marital status, national origin, ancestry, mental and physical disability, medical condition, genetic information, military and veteran status, age, and pregnancy or any other characteristic protected by law.

Performance and qualifications are the only basis upon which we hire, assign, promote, compensate, develop and retain employees. Chubb prohibits all unlawful discrimination, harassment and retaliation against any individual who reports discrimination or harassment.
Minimum:

Prior experience managing Information Security projects

Bachelor's Degree in Computer Science, Engineering, or other Engineering or Technical discipline, or equivalent relevant experience

Minimum of 2 years' professional experience performing web application, API endpoint, and mobile (iOS & Android) penetration testing

Knowledge of prioritizing remediation activities with operational teams through risk ratings of vulnerabilities and assets

Knowledge of industry standards regarding vulnerability management, including Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS)
Knowledge of technology and security topics including network security, wireless security, application security, infrastructure hardening and security baselines, and web server and database security

Knowledge of penetration testing principles, tools, and techniques

Working experience with industry frameworks (OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, NIST, NIST AI Risk Management Framework, MITRE ATT&CK, etc.)Comfortable working outside their comfort zone with a willingness to learn

Excellent verbal and written communication skills

Strong analytical skills

Strong team player with the ability to work independently

Strong project management skills and ability to multi-task

Self-motivated with strong initiative

Knowledge of computer networking concepts and protocols, and…