> Markdown version of [/jobs/ext/1373739-sr-web-app-penetration-tester](https://www.wearedevelopers.com/jobs/ext/1373739-sr-web-app-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Sr. Web App Penetration Tester

- **Company:** SixGen, Inc
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $125,000.0 - $145,000.0
- **Contract:** Permanent contract
- **Skills:** Active Directory, Application Programming Interfaces (APIs), Software System Penetration Testing, Automation of Tests, Cyber Security, Databases, Mobile Application Software, Web Application Security, Web Applications, Scripting, Cloud Platform System, Cyber Warfare, Vulnerability Analysis
- **Published:** July 22, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9047685/sr-web-app-penetration-tester

## About the Role

We are seeking a skilled and motivated Senior Web Application Penetration Tester to join our growing cyber operations team. The ideal candidate will possess deep expertise in web application security testing, vulnerability research, and exploitation techniques, with the ability to identify complex attack paths and develop creative solutions to challenging security problems., 5+ years of experience in web application penetration testing or offensive cybersecurity.
Demonstrated experience conducting manual web application security assessments.
Knowledge of modern web application vulnerabilities, attack methodologies, and exploitation techniques.
Experience with network mapping, vulnerability scanning, and penetration testing methodologies.
Familiarity with NIST 800-series standards and cybersecurity best practices.
Experience developing scripts, payloads, or custom testing tools.
Strong analytical, problem-solving, and communication skills.
Preferred Certifications

One or more of the following certifications is strongly preferred, Experience with cloud environments and post-exploitation activities.
Experience with Active Directory security assessments.
Familiarity with FISMA compliance requirements.
Experience supporting government or regulated industry clients.
Proficiency with common offensive security tools and frameworks.
COMPENSATION & BENEFITS

At SIXGEN, we are committed to fair and equitable compensation practices. Compensation for this role will be based on experience, qualifications, technical expertise, and overall alignment with the position.

## Description

This role goes far beyond automated scanning. Successful candidates will conduct in-depth assessments of web applications, APIs, mobile applications, and supporting infrastructure while leveraging custom tooling, manual testing techniques, and advanced exploitation methodologies to uncover impactful security findings., Web Application Security Assessments
Conduct penetration testing of web applications, APIs, mobile applications, databases, and client-side technologies.
Perform application enumeration, endpoint discovery, vulnerability research, and exploitation activities.
Identify, validate, and assess vulnerabilities across complex environments.
Analyze attack paths and security weaknesses to determine business and operational impact.
Technical Analysis & Research
Develop and utilize custom tools, scripts, and payloads to support testing activities.
Perform network mapping, vulnerability analysis, and security assessments across applications and supporting infrastructure.
Research emerging vulnerabilities, attack techniques, and exploitation methodologies.
Support post-exploitation activities involving cloud and enterprise environments when applicable.
Client Engagement & Reporting
Collaborate with clients and internal teams to define scope, review findings, and recommend remediation strategies.
Communicate technical concepts and findings to both technical and non-technical stakeholders.
Produce comprehensive reports, including detailed findings, exploitation procedures, risk analysis, and mitigation recommendations.
Participate in client meetings and provide ongoing updates throughout assessment activities.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Kubernetes and Microservices with Multi-Model Databases](https://www.wearedevelopers.com/videos/382-kubernetes-and-microservices-with-multi-model-databases)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Let’s write an exploit using AI](https://www.wearedevelopers.com/videos/1004-let-s-write-an-exploit-using-ai)
- [Fault Tolerance and Consistency at Scale: Harnessing the Power of Distributed SQL Databases](https://www.wearedevelopers.com/videos/1146-fault-tolerance-and-consistency-at-scale-harnessing-the-power-of-distributed-sql-databases)
- [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)
- [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Find a Developer Job: 12 Best Job Sites For Developers](https://www.wearedevelopers.com/magazine/165-find-a-developer-job-12-best-job-sites-for-developers)