Penetration Tester

Bright Security delivers an enterprise-grade, developer-centric DAST platform that helps organizations identify and remediate vulnerabilities early and continuously in the SDLC. The platform is widely used for security testing of web applications, APIs, business logic, and LLM-based solutions.

By integrating security testing into development workflows, Bright enables security and engineering teams to identify vulnerabilities earlier, improve collaboration, and accelerate remediation.

The company is developing a SaaS product that empowers Application Security & Development teams to find and fix vulnerabilities iteratively at every step in the SDLC, without slowing them down.

We are looking for a curious, thorough, and hands-on Penetration Tester to help identify and validate security risks in web applications, APIs, business logic, and other modern application environments. This is a full-time, remote role. You’ll use both manual and automated techniques, going beyond scanner results to investigate how applications behave, explore attack paths, and uncover vulnerabilities through creative, methodical testing.

You’ll own assessments from scoping through testing, evidence collection, risk assessment, and reporting. You’ll also provide practical remediation guidance and retest fixes, with a strong focus on the quality and depth of every assessment.

• Performing thorough manual and automated penetration testing of web applications and APIs.
• Independently planning and executing assigned assessments with minimal supervision.
• Testing authentication, authorization, session management, access control, business logic, input handling, and API behavior.
• Identifying vulnerabilities through manual investigation, creative testing, and analysis beyond automated scanner output.
• Developing and validating practical proof-of-concept exploitation where appropriate.
• Producing clear, detailed, customer-ready penetration testing findings and reports.
• Providing practical remediation guidance and validating fixes through retesting.
• Contributing to testing methodologies, tooling, knowledge sharing, and continuous improvement.
• Supporting additional testing areas such as cloud, mobile, red team, and AI or LLM security depending on experience.

• Demonstrable hands-on experience with penetration testing, vulnerability research, bug hunting, bug bounty work, or comparable offensive security activities.
• Strong practical knowledge of web and API security, including OWASP Top 10, OWASP API Security Top 10, authentication, authorization, access control, and business logic vulnerabilities.
• Ability to perform meaningful manual testing rather than relying primarily on automated tools.
• Strong investigative mindset, attention to detail, and ability to identify non-obvious attack paths.
• Understanding of the complete penetration testing process, including methodology, evidence collection, validation, reporting, and retesting.
• Ability to work independently with little day-to-day hand holding.
• Experience producing professional penetration testing reports with clear reproduction steps, impact, evidence, and remediation guidance.
• Very good to excellent written and spoken English, including customer-facing technical communication.
• Good understanding of HTTP, APIs, modern web architectures, networking, operating systems, authentication, and access control.

• Approximately 2 to 4 years of professional penetration testing, application security, or offensive security experience.
• Experience testing complex APIs, multi-tenant applications, authorization models, and business logic.
• Bug bounty participation or independently discovered vulnerabilities.
• Experience with…