> Markdown version of [/jobs/ext/2454674-penetration-tester](https://www.wearedevelopers.com/jobs/ext/2454674-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Penetration Tester - **Company:** Amatriot Group, LLC - **Location:** Rensselaer, NY, United States - **Experience:** Expert - **Salary:** $90,000.0 - $105,000.0 - **Contract:** Permanent contract - **Skills:** Testing (Software), Java (Programming Language), Applications Architecture, Software System Penetration Testing, Bash Shell, Burp Suite, Cloud Computing Security, Cyber Security, Mobile Application Software, Java Security, Python (Programming Language), Open Web Application Security, Fortify (Software), Secure Coding, Web Application Security, SQL Injection, Software Vulnerability Management, Scripting, Java Application Server, Software Security, Mitre Att&ck, GWAPT, Information Technology, Metasploit, Cybercrime, Api Management, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** August 3, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=c6fdfc02b39941b4 ## About the Role * Bachelor's degree in Computer Science, Information Security, or a related field., * Minimum of 6 years of development or security experience. [Required] * Experience in penetration testing or ethical hacking with a focus on Java application security. * Experience with penetration testing tools such as Burp Suite and Metasploit. * Familiarity with Fortify on Demand SAST and DAST tools., * Strong knowledge of Java programming and Java security practices. * Scripting experience. * Proficiency in web application security principles, including OWASP. * Knowledge of common web vulnerabilities, including SQL injection and cross-site scripting, and exploit techniques. * Strong understanding of cryptography and secure communication protocols, including SSL/TLS. * Excellent problem-solving and analytical skills. * Strong communication skills. * High ethical standards and confidentiality. * Familiarity with the MITRE ATT&CK Framework., * Certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or other industry security certifications. * Experience with scripting languages, such as Python or Bash. * Experience with secure code review for Java. * Familiarity with cloud security testing. * Experience with mobile application penetration testing. * Knowledge of regulations such as HIPAA. * Experience with API testing. ## Description A Penetration Tester with a focus on Java application security identifies, exploits, and supports remediation of vulnerabilities in Java applications to help guard against cyber threats., * Conduct penetration tests and vulnerability assessments for Java applications and infrastructure. * Identify security flaws in Java code using automated and manual methods. * Create and use custom exploits to test application security, simulating attacker tactics. * Manipulate URLs, query parameters, and application browser data to identify penetration avenues. * Validate and assess browser tokens, cache manipulation, and production versus non-production architecture. * Assist in responding to security incidents related to Java vulnerabilities and current published NIST CVEs., * Collaborate with development teams to understand application architecture and identify security weaknesses early. * Collaborate with testing teams to integrate security testing with manual and automated testing. * Provide guidance on secure coding and vulnerability remediation. * Help improve secure development lifecycle processes. * Contribute to security policies for Java development and deployment. Reporting, Communication, and Threat Awareness * Clearly document and report findings, including technical details, risk assessments, and recommended solutions. * Communicate findings and recommendations to both technical and non-technical staff. * Stay updated on Java security threats and best practices. * Apply familiarity with the MITRE ATT&CK Framework. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) ## Related Articles - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [93 Java Interview Questions You Should Prepare For](https://www.wearedevelopers.com/magazine/14-93-java-interview-questions-you-should-prepare-for) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)