> Markdown version of [/jobs/ext/2024230-penetration-tester-web-hardware-iot](https://www.wearedevelopers.com/jobs/ext/2024230-penetration-tester-web-hardware-iot). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Penetration Tester - Web & Hardware/IoT - **Company:** JPMorgan Chase & Co. - **Location:** Atlanta, GA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Microsoft Windows, Application Programming Interfaces (APIs), Amazon Web Services, Android Software Development, Apple IOS, Software System Penetration Testing, User Authentication, Automation of Tests, Microsoft Azure, Burp Suite, Unix, Cloud Computing, Code Review, Cyber Security, Fat Client, Firmware, Systems Analysis, Internet Security, Mobile Application Software, Python (Programming Language), Nmap, Open Web Application Security, Remote Administration, Reverse Engineering, Web Applications, Web Testing, Rust (Programming Language), Transaction Processing (Computing), Scripting, Google Cloud, Software Security, GWAPT, Metasploit - **Published:** August 11, 2026 - **Apply:** https://www.careerbuilder.com/job-details/senior-penetration-tester-web-hardware-iot-atlanta-ga--b48ca8a1-c9c4-465b-a3e0-a4aaa8d8fc23 ## About the Role We are seeking candidates with a passion for offensive security, deep technical expertise in penetration testing, and a commitment to continuous learning and excellence., * 5+ years of hands-on penetration testing experience in offensive security, with a proven track record of scoping, executing, and reporting on complex engagements. * Expertise in manual penetration testing of web, API, cloud (AWS/Azure/GCP), infrastructure, thick-client, and/or mobile (Android/iOS) applications, including the use of industry-standard tools (e.g., Burp Suite, Nmap, Metasploit, etc.). * Working knowledge of testing approaches for connected devices/IoT and purpose-built banking devices (e.g., ATMs, POS), including common attack surfaces such as exposed services, remote administration paths, authentication/authorization, hardening gaps, and insecure configurations. * Strong understanding of security assessment methodologies such as OWASP Top Ten, NIST Cybersecurity Framework, and other relevant standards. * Ability to identify and articulate systemic security issues related to threats, vulnerabilities, and risks, and provide clear, actionable recommendations for remediation. * Exceptional organizational and communication skills, including the ability to write detailed technical reports and present findings to both technical and non-technical stakeholders. * Experience conducting peer reviews of penetration test reports and mentoring junior testers. * Continuous learner who keeps up with the latest offensive security trends, tools, and techniques. Preferred qualifications, capabilities, and skills * Knowledge of cybersecurity practices, operational risk management, and incident response methodologies within the US financial services sector, including relevant regulations, threats, and risks. * Proficiency in penetration testing and security concepts for both Windows and Unix-like operating systems. * Experience conducting security-focused source code reviews (e.g., Python, Java, Rust). * Experience in reverse engineering thick-client and mobile applications to identify vulnerabilities. * Experience assessing embedded systems / IoT devices in lab or onsite environments (e.g., device interface review, firmware/configuration analysis, and network/service exposure testing) relevant to ATM/POS ecosystems. * Relevant certifications such as OSWE, CREST (CRT, CCT), OSCP, OSCE, GXPN, GWAPT, GPEN, GMOB, or BSCP., ATM, Amazon Web Services (AWS), Analysis Skills, Android, Application Programming Interface (API), Applications Security, Asset Management, Authentication, Banking Services, Business Banking, Cloud Computing, Code Reviews, Commercial Banking, Communication Skills, Compensation and Benefits, Computer Firmware, Computer Security, Continuous Improvement, Diversity, Documentation, Ecosystems, Embedded Systems, Financial Services, Financial Transactions, GCP (Good Clinical Practices), Government, Incident Response, Industry Standards, Internet Application, Internet Security, Internet of Things, Investment Services, Java, Laboratory Testing, Logistics, Mentoring, Metasploit, Microsoft Windows Azure, Microsoft Windows Operating System, Mobile Applications, NMap, Operating Systems, Operations Management, Organizational Skills, Penetration Testing, Product Engineering, Python Programming/Scripting Language, Quality Assurance Methodology, Regulations, Regulatory Requirements, Reporting Skills, Reverse Engineering, Risk Analysis, Risk Management, Sales, Scripting (Scripting Languages), Security Analysis, Security Attacks, Small Business, Systems Analysis, Technical Presentation, Test Automation, Testing, Thick Client, Transaction Processing/Management, U.S. National Institute of Standards and Technology (NIST), Unix Operating Systems, Web Testing, Writing Skills, iOS ## Description As an Assessments & Exercises Vice President in the Cybersecurity and Technology Controls organization, you will play a key role in safeguarding the firm's most vital assets. Your primary responsibility will be to plan, execute, and report on penetration tests targeting high-impact applications, platforms, services, and - on a more limited basis - banking hardware and IoT endpoints (e.g., ATMs, Point of Sale devices, and other connected devices). Leveraging industry-standard methodologies and advanced techniques, you will proactively identify vulnerabilities, collaborate with application owners to understand root causes, and guide effective remediation to strengthen the firm's security posture., * Plan, scope, and execute penetration testing engagements across a variety of environments, including web applications, APIs, cloud platforms, infrastructure, thick-client, and/or mobile applications (primary focus). * Perform security assessments of banking hardware and connected/IoT technologies (limited but expected), such as ATMs, Point of Sale (POS) devices, and other embedded endpoints. * Collect and validate pre-requisites for each engagement, ensuring all necessary access, documentation, and approvals are in place (including lab/onsite testing logistics and device access where applicable). * Perform manual and automated testing to identify vulnerabilities, misconfigurations, and security weaknesses, leveraging industry-standard tools and custom scripts. * Document and communicate findings through comprehensive reports that include technical details, risk assessments, and actionable remediation recommendations. * Conduct peer reviews of penetration test reports to ensure accuracy, consistency, and quality of deliverables. * Collaborate with development, infrastructure, security, and device/product engineering teams to clarify findings, support remediation efforts, and provide subject matter expertise on offensive security. * Stay current with emerging threats, vulnerabilities, and attack techniques by leveraging threat intelligence, security research, and participation in relevant industry groups. * Contribute to the continuous improvement of penetration testing methodologies, tools, and frameworks to enhance effectiveness and alignment with firm strategy and regulatory requirements. ## Related Videos - [WeAreDevelopers LIVE - Node and Package Security](https://www.wearedevelopers.com/videos/2138-wearedevelopers-live-node-and-package-security) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [The Time Paradox: Building Timezone-Safe Python/Django Applications](https://www.wearedevelopers.com/videos/1915-the-time-paradox-building-timezone-safe-python-django-applications) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) - [Securing Your Web Application Pipeline From Intruders](https://www.wearedevelopers.com/videos/53-securing-your-web-application-pipeline-from-intruders) - [Coffee with Developers - Robby Russell](https://www.wearedevelopers.com/videos/917-coffee-with-developers-robby-russell) ## Related Articles - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Best Coding Boot Camps in Germany](https://www.wearedevelopers.com/magazine/237-best-coding-boot-camps-in-germany) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)