> Markdown version of [/jobs/ext/3699495-penetration-tester-ethical-hacker](https://www.wearedevelopers.com/jobs/ext/3699495-penetration-tester-ethical-hacker). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Penetration Tester / Ethical Hacker - **Company:** Hudson - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Testing (Software), Java (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, User Authentication, Bash Shell, Burp Suite, Cloud Computing Security, Cyber Security, Computer Programming, Java Platform Enterprise Edition (J2EE), Hypertext Transfer Protocols (HTTP), Mobile Application Software, Python (Programming Language), Open Web Application Security, Fortify (Software), Secure Coding, Simple Object Access Protocol (SOAP), Software Engineering, SQL Injection, Scripting, Java Application Server, Enterprise Software Applications, Software Security, Mitre Att&ck, Cross-Site Scripting (XSS), GWAPT, Information Technology, Metasploit, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** October 12, 2026 - **Apply:** https://www.dice.com/job-detail/263cc235-ac8c-401c-94d9-a88e0abdab3b ## About the Role * Education: Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field. * Minimum 6 years of combined Development and/or Security experience. * Prior software engineering/development experience, including Core Java coding. * Hands-on Penetration Testing / Ethical Hacking experience focused on Java/J2EE application security. * Experience supporting a large-scale, public-facing enterprise application. * Experience working in a DevSec or application security environment. REQUIRED TECHNICAL / FUNCTIONAL SKILLS * Core Java programming and strong understanding of Java application architecture and security practices. * Hands-on web application penetration testing using manual and automated techniques. * Ability to validate and exploit vulnerabilities and create/modify proof-of-concept exploits. * Manipulation of URLs, query parameters, HTTP requests, browser data, tokens, sessions, and cache behavior. * OWASP-related vulnerabilities and exploitation techniques, including SQL injection, XSS, authentication and authorization weaknesses. * Hands-on use of Burp Suite and familiarity with Metasploit. * Familiarity with Fortify on Demand SAST/DAST and MITRE ATT&CK. * Understanding of cryptography and SSL/TLS. * Scripting experience supporting penetration testing and security analysis. * Ability to clearly document technical findings, exploitability, risk, evidence, and remediation., * OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or comparable certification. * Python, Bash, or other penetration-testing scripting experience. * Secure Java code review experience. * API penetration testing experience, including REST and/or SOAP. * Cloud security testing and/or mobile application penetration testing. * HIPAA or comparable regulated-environment knowledge. * SCA/SBOM experience identifying vulnerable third-party components. * AI-assisted security tools used to identify vulnerabilities or attack paths, with manual validation of exploitability. CANDIDATE PROFILE * Candidate should clearly explain a current/recent Java application they personally penetration tested, including application purpose and architecture. * Candidate should distinguish their individual role and the penetration testing activities they personally performed. * Candidate should provide specific examples of vulnerabilities personally identified, exploited, validated, documented, and retested. * Candidate should explain hands-on Burp Suite use rather than relying solely on automated scanning. * Candidate should demonstrate how Java development knowledge contributes to vulnerability identification and collaboration with Development. * Candidate should distinguish Hands-on Experience, Working Knowledge, and Exposure. ## Description * The Penetration Tester / Ethical Hacker is responsible for identifying, validating, exploiting, and supporting remediation of security vulnerabilities within large-scale Java applications. This is a hands-on technical role focused on application penetration testing and ethical hacking using real-world attack techniques. * The successful candidate will combine strong Java development/engineering knowledge with practical penetration testing experience and work closely with Development and Testing teams to identify vulnerabilities, validate exploitability, and strengthen application security., * Conduct hands-on penetration tests and vulnerability assessments of Java applications and supporting infrastructure. * Identify application security weaknesses using manual and automated techniques. * Simulate attacker techniques and develop or modify exploits to determine actual exploitability. * Analyze workflows, authentication, authorization, sessions, tokens, browser data, URLs, query parameters, and other attack surfaces. * Collaborate with Development teams to understand architecture, identify weaknesses, and provide remediation/secure coding guidance. * Collaborate with Testing teams to integrate security considerations into manual and automated testing. * Document findings, technical evidence, risk, business impact, and recommended corrective actions. * Validate remediation through follow-up testing and retesting. * Monitor relevant Java threats, vulnerabilities, and published NIST CVEs. * Support secure SDLC improvement and application security standards/practices.