> Markdown version of [/jobs/ext/163236-senior-cyber-security-research-engineer](https://www.wearedevelopers.com/jobs/ext/163236-senior-cyber-security-research-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Cyber Security Research Engineer... - **Company:** Wells Fargo - **Location:** Charlotte, NC, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, Automation of Tests, Burp Suite, Cyber Security, Fat Client, Fiddler (Software), Mobile Application Software, Python (Programming Language), Mainframes, Open Web Application Security, PCI Data Security Standards, Performance Tuning, Web Applications, Webinspect, GitHub Copilot, Software Security, GWAPT, Performance Monitor, Dynamic Application Security Testing - **Published:** May 15, 2026 - **Apply:** https://www.juju.com/job/00000000fzmedy ## About the Role + 4+ years of Cyber Security Research experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education + 2+ years of hands-on application penetration testing experience (manual testing required), beyond reviewing/validating automated scanner results + 2+ years of Dynamic Application Security Testing (DAST) experience, including tool configuration/tuning and manual verification of findings Desired Qualifications: + Advanced experience with testing tools such as Burp Suite, Invicti, WebInspect, and Fiddler (and applying them to web, API, mobile, and thick client testing as applicable) + Advanced knowledge of application security and common vulnerabilities (OWASP Top 10) + Experience with scripting and automation (e.g., Python, Shell) + Knowledge of security best practices and compliance standards (e.g., PCI DSS, GDPR) + Excellent communication skills and the ability to collaborate effectively with cross-functional teams + Strong problem-solving and analytical skills + Demonstrated knowledge of AI/ML-enabled applications and common security risks (for example, prompt injection, sensitive data exposure, and insecure integrations) + Security certifications such as OSCP, BSCP, GWAPT, GPEN, GXPN or equivalent are a plus ## Description Wells Fargo is seeking a Senior Application Pen Tester to identify, validate, and exploit security vulnerabilities through hands-on, manual testing across a broad range of application technologies (browser-based/web, APIs, mobile, mainframe, and thick client). Successful candidates will have demonstrable, real-world manual penetration testing experience and be comfortable going beyond automated scanner output to reproduce, validate, and investigate findings. Success in this role means delivering high-confidence, reproducible vulnerabilities with clear evidence and practical remediation guidance, and partnering with application teams to drive timely fixes. In this role, you will: + Conduct application penetration testing across browser-based/web applications, APIs, and mobile applications (and where applicable mainframe and thick client applications) using primarily manual techniques supplemented by automated tools; include authentication/authorization testing and business-logic abuse cases where applicable + Configure and tune automated tools to support testing, improve coverage, and accelerate discovery (as a complement to manual testing) + Perform deep defect analysis by reproducing, validating, and safely demonstrating impact (including chained attack paths when applicable); triage and disposition false positives from automated tooling + Produce clear, reproducible technical reports with evidence (steps to reproduce, impacted components/endpoints, and risk/impact) and practical remediation guidance + Collaborate with application and security teams to ensure shared understanding of defects, prioritization, and remediation paths; support defect walkthroughs and follow-up questions as needed + Support continuous improvement of testing methodologies and processes leveraging industry standards and best practices + Collaborate with other members of the team to share knowledge and complete peer reviews of reports + Communicate findings and risk clearly to technical and non-technical stakeholders; support readouts, status updates, and remediation Q&A + Demonstrate proficiency in using AI assisted development and analysis tools (e.g., GitHub Copilot and approved code centric agents), Employees support our focus on building strong customer relationships balanced with a strong risk mitigating and compliance-driven culture which firmly establishes those disciplines as critical to the success of our customers and company. They are accountable for execution of all applicable risk programs (Credit, Market, Financial Crimes, Operational, Regulatory Compliance), which includes effectively following and adhering to applicable Wells Fargo policies and procedures, appropriately fulfilling risk and compliance obligations, timely and effective escalation and remediation of issues, and making sound risk decisions. There is emphasis on proactive monitoring, governance, risk identification and escalation, as well as making sound risk decisions commensurate with the business unit's risk appetite and all risk and compliance program requirements. ## Related Videos - [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)