> Markdown version of [/jobs/ext/1665899-penetration-tester](https://www.wearedevelopers.com/jobs/ext/1665899-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Penetration Tester - **Company:** Donato Technologies, Inc - **Location:** Albany, NY, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Applications Architecture, Software System Penetration Testing, Automation of Tests, Bash Shell, Burp Suite, Cloud Computing Security, Cyber Security, Mobile Application Software, Java Security, Python (Programming Language), Open Web Application Security, Systems Development Life Cycle, Fortify (Software), Secure Coding, Web Application Security, SQL Injection, Scripting, Java Application Server, Software Security, Mitre Att&ck, Cross-Site Scripting (XSS), GWAPT, Information Technology, Metasploit, Cybercrime, Api Management, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** July 15, 2026 - **Apply:** https://www.careerjet.com/jobad/us372e5ef46fb66e836f6c1e23bebda88f ## About the Role We are seeking a skilled Penetration Tester with a focus on Java application security is sought to identify, exploit, and fix vulnerabilities in Java applications to guard against cyber threats., * Bachelor s degree in a related software field with 6+ years in a Dev Sec role. * Core Java coding experience. * Previous job background as an engineer and Dev Sec position on a large scale public enterprise scale application. * Bachelor's degree in Computer Science, Information Security, or a related field. * Minimum of 6 years of Development/Security experience * Experience in Penetration Testing/Ethical Hacking with a focus on Java application security. * Strong knowledge of Java programming and its security practices as well as scripting experience. * Proficiency in web application security principles (e.g., OWASP). * Knowledge of common web vulnerabilities (e.g., SQL injection, XSS) and exploit techniques. * Experience with penetration testing tools like Burp Suite, Metasploit. * Familiarity with Fortify on Demand SAST and DAST tools. * Strong understanding of cryptography and secure communication protocols (e.g., SSL/TLS). * Excellent problem-solving and analytical skills. * Strong communication skills. * High ethical standards and confidentiality., * Certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP or other industry security certifications. * Experience with scripting languages (e.g., Python, Bash). * Experience with secure code review for Java. * Familiarity with cloud security testing. * Experience with mobile application penetration testing. * Knowledge of regulations like HIPAA. * Experience with API testing, Required Qualifications Bachelor's degree in a related software field with 6+ years in a Dev Sec role. Core Java coding experience. Previous job background as an engineer and D… ## Description * Conduct penetration tests and vulnerability assessments for Java applications and infrastructure. * Identify security flaws in Java code using automated and manual methods. * Create and use custom exploits to test application security, simulating attacker tactics. * Collaborate with Development teams to understand application architecture and find security weaknesses early. * Collaborate with Testing teams to integrate with manual and automation testing. * Provide guidance on secure coding and how to fix vulnerabilities. * Stay updated on Java security threats and best practices. * Help improve secure development processes (SDLC). * Assist in responding to security incidents related to Java vulnerabilities, current published NIST CVE. * Clearly document and report findings, including technical details, risk assessment, and recommended solutions. * Communicate findings and recommendations to both technical and non-technical staff. * Contribute to security policies for Java development and deployment. * Manipulate URLs, query parameters and Application browser data to look for penetration avenues. Validate and asses browser tokens and cache manipulation and Production vs. none prod architecture. * Familiar with MITRE ATT&CK Framework. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) - [MCP doesn’t suck — your agent does](https://www.wearedevelopers.com/videos/100202-mcp-doesn-t-suck-your-agent-does) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) ## Related Articles - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [93 Java Interview Questions You Should Prepare For](https://www.wearedevelopers.com/magazine/14-93-java-interview-questions-you-should-prepare-for) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Should senior developers refuse interview coding challenges?](https://www.wearedevelopers.com/magazine/29-should-senior-developers-refuse-interview-coding-challenges) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)