> Markdown version of [/jobs/ext/1403842-senior-penetration-tester](https://www.wearedevelopers.com/jobs/ext/1403842-senior-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Penetration Tester - **Company:** CoStar Realty Information Inc. - **Location:** Arlington, VA, United States (Remote available) - **Experience:** Expert - **Salary:** $115,000.0 - $203,000.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Active Directory, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Business Logic, Software System Penetration Testing, Systems Engineering, Burp Suite, C Sharp (Programming Language), Cloud Engineering, Cyber Security, Computer Programming, Continuous Integration, Intrusion Detection and Prevention, Mobile Application Software, Python (Programming Language), Nmap, Windows PowerShell, Red Team (Cyber Security), Secure Coding, Software Engineering, Web Applications, Mitre Att&ck, Kubernetes, Information Technology, Metasploit, Purple Team (Cyber Security) - **Published:** July 23, 2026 - **Apply:** https://dejobs.org/x/x/9E5CE706FF1D4EC0A097D4B2FD2C5E0E/job/ ## About the Role * Bachelor's Degree required from an accredited, not for profit, in person university or college (preferably in Computer Science, Cybersecurity, or related field). * A track record of commitment to prior employers. * 6 years of total experience in a technical role such as security, software development, or systems engineering, with at least 3 years focused on penetration testing or offensive security. * Demonstrated experience with web application and API penetration testing, including identifying and exploiting attack chains across complex application logic, authentication, and authorization flows. * Experience writing reports that clearly demonstrate vulnerability risk, business impact, and remediation paths to developers and senior leadership. * Ability to perform secure code review and identify vulnerabilities in source code, including authentication, authorization, injection, and business logic flaws. * Scripting and programming proficiency in Python, PowerShell, or similar, with the ability to read and understand application code in languages like C#, Java, JavaScript, or Go. * Understanding of defense-in-depth principles and ability to recommend layered mitigations beyond fixing individual findings. * Security certifications such as OSCP, OSWE, OSEP, GPEN, GXPN, or similar., * In-depth experience with offensive security tools such as Burp Suite, OWASP ZAP, Nmap, Bloodhound, and Metasploit. * Familiarity with Active Directory exploitation tools and techniques. * Familiarity with C2 frameworks such as Cobalt Strike, Sliver, or Mythic. * Experience planning and executing red team and purple team scenarios. * Experience with adversary emulation methodologies and frameworks (MITRE ATT&CK). * Experience testing modern applications in cloud-native tech stacks. * Experience with mobile application penetration testing. * Familiarity with AI and LLM security testing, including prompt injection, indirect prompt injection, agentic system risks, and MCP server assessment. * Hands-on experience implementing security tools into CI/CD pipelines. * Working knowledge of network, system, and database administration concepts as they relate to attack surface analysis. * Strong communication skills with both technical teams and senior leadership, particularly translating technical exploits into business risk. * Experience coordinating with application teams to drive security by design principles. * Ability to mentor and train team members on offensive techniques and risk prioritization. * A self-starter who follows ideas through to completion and drives offensive security work forward independently. ## Description We have been living and breathing the world of real estate information and online marketplaces for over 35 years. This extensive experience gives us the perspective to create truly unique and valuable offerings to our customers. We've continually refined, transformed, and perfected our approach to our business. Creating a language that has become standard in our industry, for our customers, and even our competitors. We continue that effort today and are always working to improve and drive innovation. This is how we deliver for our customers, our employees, and investors. By equipping the brightest minds with the best resources available, we provide an invaluable edge in real estate. Evolve our security pentesting capabilities to test our internal and external facing processes, infrastructure, and applications. This position will be tasked with developing test plans to validate identified vulnerabilities and demonstrate the exploitation of the vulnerabilities. The ability to explain the exploit to senior level management is key to success in this role. Stay current with trends, techniques, and tools used by adversaries. This position is located in Arlington, VA and is in office Monday through Thursday with work from home on Friday. Responsibilities * Lead penetration tests on web applications and underlying infrastructure for vulnerabilities using both manual and automated techniques. * Develop test plans that validate identified vulnerabilities and demonstrate exploitability to engineering teams, security peers, and senior leadership. * Collaborate with detection engineering and incident response on purple team exercises, validating that preventative and detective controls behave as expected against realistic adversary techniques. * Grow the team's pentesting capabilities in infrastructure and cloud-native domains, including CI/CD pipelines, Active Directory, AWS, and Kubernetes. * Recommend remediations that address root causes, including code changes, architectural improvements, and control adjustments. * Stay current with attacker tradecraft. Share knowledge with the broader security team and mentor engineers on offensive techniques and how to think like an attacker. ## Related Videos - [Understanding Kubernetes in a visual way](https://www.wearedevelopers.com/videos/100085-understanding-kubernetes-in-a-visual-way) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Instant KAI Sandboxes with vCluster: Multi-Tenant, Multi-Scheduler GPU Sharing](https://www.wearedevelopers.com/videos/100333-instant-kai-sandboxes-with-vcluster-multi-tenant-multi-scheduler-gpu-sharing) - [Securing Your Web Application Pipeline From Intruders](https://www.wearedevelopers.com/videos/53-securing-your-web-application-pipeline-from-intruders) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) - [Microservices: how to get started with Spring Boot and Kubernetes](https://www.wearedevelopers.com/videos/242-microservices-how-to-get-started-with-spring-boot-and-kubernetes) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Should senior developers refuse interview coding challenges?](https://www.wearedevelopers.com/magazine/29-should-senior-developers-refuse-interview-coding-challenges) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)