> Markdown version of [/jobs/ext/3062153-sr-penetration-tester](https://www.wearedevelopers.com/jobs/ext/3062153-sr-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Sr. Penetration Tester

- **Company:** Amyx, Inc.
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $249,600.0 - $332,800.0
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Active Directory, Application Programming Interfaces (APIs), Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Bash Shell, Burp Suite, Cloud Computing Security, Cyber Security, Computer Programming, Mobile Application Software, Python (Programming Language), Network Security, Nmap, OAuth, Open Web Application Security, PCI Data Security Standards, Phishing, Red Team (Cyber Security), Mobile Security, Wireshark, Web Applications, Scripting, Google Cloud, Cloud Platform System, Software Security, Mitre Att&ck, Information Technology, Metasploit, Nessus, Vulnerability Analysis
- **Published:** September 25, 2026
- **Apply:** https://www.builtincolorado.com/auth/login?destination=/job/penetration-tester/11362929

## About the Role

* Proven experience (3+ years) in penetration testing across web apps, mobile apps, APIs, and network environments.
 * Expertise in internal and external network penetration testing.
 * Knowledge of common security vulnerabilities and attack vectors, such as those listed in OWASP Top 10 and MITRE ATT&CK.
 * Familiarity with industry-standard tools like Burp Suite, Nmap, Metasploit, Wireshark, Nessus, and others.
 * Experience with cloud environments (AWS, Azure, Google Cloud) is a plus.
 * Strong understanding of GDPR, PCI-DSS, SOC 2, and other regulatory frameworks.
 * Excellent verbal and written communication skills, with the ability to present findings to technical and non-technical audiences.

Preferred Skills & Certifications:

 * Offensive Security Certified Professional (OSCP), Certified Ethical Hacker (CEH), GIAC Penetration Tester (GPEN), or similar certifications.
 * Experience with mobile security frameworks and tools such as OWASP Mobile Security Testing Guide (MSTG).
 * Experience in API security testing, including OAuth and other common API security models.
 * Proficiency in one or more programming/scripting languages (Python, Bash, JavaScript, etc.).

## Description

Be an Early Applicant
In-Office or Remote
Hiring Remotely in United States
120-160 Hourly
Mid level
In-Office or Remote
Hiring Remotely in United States
120-160 Hourly
Mid level
Conduct web, mobile, API, network, and social engineering penetration tests; identify vulnerabilities, develop technical reports, recommend mitigations, and present findings to clients. Ensure assessments align with GDPR, PCI-DSS, SOC 2, and other standards while tracking emerging threats. The role is remote and contract-based, with cloud security, certifications, mobile testing, API security, and scripting experience preferred.
The summary above was generated by AI

Velero is a cybersecurity and compliance consulting firm helping clients navigate complex regulatory requirements through expert-led assessments, advisory services, and practical security execution. Working across the computer and network security space, we partner with organizations to strengthen their security posture with clear, actionable guidance grounded in real-world risk.

In this role, you will help clients uncover vulnerabilities across a range of environments and contribute to security assessments that support both technical resilience and regulatory readiness. This is an opportunity for a penetration tester who enjoys tackling varied engagements, communicating findings clearly, and translating complex security issues into practical next steps for internal teams and clients.
Responsibilities

 * Conduct penetration tests on web applications, mobile applications, and APIs to identify vulnerabilities and potential exploits.
 * Perform network penetration testing, including internal and external network assessments, to ensure comprehensive coverage of security weaknesses.
 * Implement social engineering techniques such as phishing campaigns to simulate real-world attacks and identify human-related security risks.
 * Prepare detailed technical reports and provide actionable recommendations based on the results of penetration tests.
 * Collaborate with internal teams and external clients to discuss findings, mitigation strategies, and security best practices.
 * Ensure compliance with relevant security standards and regulations, including GDPR, PCI-DSS, SOC 2, and others.
 * Stay up to date on emerging threats, vulnerabilities, and security best practices., Performs application, network, wireless, and enclave penetration testing for a DoD client. Identifies cybersecurity vulnerabilities, develops mitigation strategies, coordinates testing with system owners, and prepares assessment reports and recommendations. The role requires extensive vulnerability assessment experience, knowledge of Windows, Linux, networking, OWASP, PCI DSS, scripting, and penetration testing tools. A DoD Secret clearance and eligibility for IT-I Critical Sensitive or Tier 5 clearance are required.
Top Skills: BashBurp SuiteCanvasIisJavaKismetLinuxMetasploitNessusNmapOwaspPci DssPerlPythonRubyTcp/IpWindows ServerWireless Lan Security
CACI International Inc


## Related Videos

- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them)
- [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Maturity assessment for technicians or how I learned to love OWASP SAMM](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm)
- [Advanced Cypress: custom assertions and tasks](https://www.wearedevelopers.com/videos/790-advanced-cypress-custom-assertions-and-tasks)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)