WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Back

Penetration Tester / Ethical Hacker

Hudson
United States
5 days ago
Apply on www.dice.com
Prepare application

Role details

Contract type
Permanent contract
Employment type
Full-time (> 32 hours)
Experience level
Expert
Experience required
6 years minimum
Working hours
Regular working hours
Job source
www.dice.com

Tech stack

Testing (Software) Java (Programming Language) Application Programming Interfaces (APIs) Artificial Intelligence Software System Penetration Testing User Authentication Bash Shell Burp Suite Cloud Computing Security Cyber Security Computer Programming Java Platform Enterprise Edition (J2EE)
+21 more
Hypertext Transfer Protocols (HTTP) Mobile Application Software Python (Programming Language) Open Web Application Security Fortify (Software) Secure Coding Simple Object Access Protocol (SOAP) Software Engineering SQL Injection Scripting Java Application Server Enterprise Software Applications Software Security Mitre Att&ck Cross-Site Scripting (XSS) GWAPT Information Technology Metasploit Static Application Security Testing Vulnerability Analysis Dynamic Application Security Testing

Job description

  • The Penetration Tester / Ethical Hacker is responsible for identifying, validating, exploiting, and supporting remediation of security vulnerabilities within large-scale Java applications. This is a hands-on technical role focused on application penetration testing and ethical hacking using real-world attack techniques.
  • The successful candidate will combine strong Java development/engineering knowledge with practical penetration testing experience and work closely with Development and Testing teams to identify vulnerabilities, validate exploitability, and strengthen application security., * Conduct hands-on penetration tests and vulnerability assessments of Java applications and supporting infrastructure.
  • Identify application security weaknesses using manual and automated techniques.
  • Simulate attacker techniques and develop or modify exploits to determine actual exploitability.
  • Analyze workflows, authentication, authorization, sessions, tokens, browser data, URLs, query parameters, and other attack surfaces.
  • Collaborate with Development teams to understand architecture, identify weaknesses, and provide remediation/secure coding guidance.
  • Collaborate with Testing teams to integrate security considerations into manual and automated testing.
  • Document findings, technical evidence, risk, business impact, and recommended corrective actions.
  • Validate remediation through follow-up testing and retesting.
  • Monitor relevant Java threats, vulnerabilities, and published NIST CVEs.
  • Support secure SDLC improvement and application security standards/practices.

Requirements

  • Education: Bachelor’s degree in Computer Science, Information Security, Software Engineering, or a related technical field.
  • Minimum 6 years of combined Development and/or Security experience.
  • Prior software engineering/development experience, including Core Java coding.
  • Hands-on Penetration Testing / Ethical Hacking experience focused on Java/J2EE application security.
  • Experience supporting a large-scale, public-facing enterprise application.

  • Experience working in a DevSec or application security environment. REQUIRED TECHNICAL / FUNCTIONAL SKILLS

  • Core Java programming and strong understanding of Java application architecture and security practices.
  • Hands-on web application penetration testing using manual and automated techniques.
  • Ability to validate and exploit vulnerabilities and create/modify proof-of-concept exploits.
  • Manipulation of URLs, query parameters, HTTP requests, browser data, tokens, sessions, and cache behavior.
  • OWASP-related vulnerabilities and exploitation techniques, including SQL injection, XSS, authentication and authorization weaknesses.
  • Hands-on use of Burp Suite and familiarity with Metasploit.
  • Familiarity with Fortify on Demand SAST/DAST and MITRE ATT&CK.
  • Understanding of cryptography and SSL/TLS.
  • Scripting experience supporting penetration testing and security analysis.
  • Ability to clearly document technical findings, exploitability, risk, evidence, and remediation., * OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or comparable certification.
  • Python, Bash, or other penetration-testing scripting experience.
  • Secure Java code review experience.
  • API penetration testing experience, including REST and/or SOAP.
  • Cloud security testing and/or mobile application penetration testing.
  • HIPAA or comparable regulated-environment knowledge.
  • SCA/SBOM experience identifying vulnerable third-party components.

  • AI-assisted security tools used to identify vulnerabilities or attack paths, with manual validation of exploitability. CANDIDATE PROFILE

  • Candidate should clearly explain a current/recent Java application they personally penetration tested, including application purpose and architecture.
  • Candidate should distinguish their individual role and the penetration testing activities they personally performed.
  • Candidate should provide specific examples of vulnerabilities personally identified, exploited, validated, documented, and retested.
  • Candidate should explain hands-on Burp Suite use rather than relying solely on automated scanning.
  • Candidate should demonstrate how Java development knowledge contributes to vulnerability identification and collaboration with Development.
  • Candidate should distinguish Hands-on Experience, Working Knowledge, and Exposure.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.dice.com
Prepare application

Good distractions

Loading talks and stories from around this role…