Application Penetration Tester

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Penetration Tester based in the United States.

We are seeking an experienced Application Penetration Tester to strengthen the security of web applications and REST APIs within a federal healthcare program. In this fully remote role, you will play a key part in identifying, assessing, and mitigating application-level security vulnerabilities. You will conduct comprehensive penetration tests, secure code reviews, and architecture assessments across applications built with technologies such as Java, Scala, and JavaScript. Using industry-leading tools and frameworks, you will help development teams address security risks and implement robust security practices. You will also contribute to integrating automated security testing into DevOps and CI/CD pipelines. This is an opportunity to make a meaningful impact on application security in a mission-critical federal environment.

• Collaborate with development teams and stakeholders to identify, define, and translate security requirements into practical application security measures.
• Establish, maintain, and promote application security best practices, ensuring alignment with recognized industry standards.
• Assess the security of third-party libraries, software components, and dependencies to identify potential risks.
• Conduct manual and automated secure code reviews of Java and Scala applications, identifying vulnerabilities such as Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL injection, and privilege escalation, and recommending appropriate remediation strategies.
• Analyze and interpret findings from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools, providing actionable recommendations across different applications, languages, and platforms.
• Perform static, dynamic, and manual penetration testing of web applications and REST APIs, primarily using Burp Suite.
• Review software security architecture and application designs to identify weaknesses and recommend improvements.
• Prepare comprehensive security assessment reports documenting vulnerabilities, findings, risk levels, test outcomes, and remediation recommendations.
• Demonstrate identified vulnerabilities to application owners and guide technical teams toward effective security remediation.
• Develop scripts and integrate security tools into DevOps and CI/CD pipelines to automate application security testing and improve development workflows.

Requirements:

• At least 3 years of professional experience in secure code review, particularly with Java, Scala, JavaScript, and the Spring Framework.
• At least 3 years of practical experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• 3+ years of hands-on experience conducting manual penetration testing of web applications and REST APIs using Burp Suite Professional and tools such as Postman or Bruno.
• Strong understanding of secure coding practices, application security principles, and DevSecOps methodologies.
• In-depth knowledge of the OWASP Top 10 and SANS Top 25, including their associated security risks and testing guidelines.
• Familiarity with CI/CD processes, AWS security principles, Jenkins, and GitHub.
• Ability to analyze complex security findings, communicate technical risks clearly, and provide practical remediation guidance to development teams and stakeholders.
• Strong analytical, problem-solving, communication, and technical documentation skills.
• Must be a U.S. citizen and able to successfully pass a federal background investigation to obtain access to sensitive information.
• Preferred certifications include GPEN, GWAPT, OSCP, or CompTIA PenTest+.

Benefits:

• Annual salary: $109,600–$137,000.
• Full-time, fully remote work arrangement within the United States.
• Opportunity to contribute to application security initiatives within a federal healthcare program.
• Hands-on experience with industry-standard penetration testing tools, security frameworks, and DevSecOps technologies.
• Opportunity to collaborate with development, security, and technical stakeholders on meaningful cybersecurity challenges.
• Exposure to enterprise application security, vulnerability management, and automated security testing practices.