Application Penetration Tester

• Serve as a liaison between development teams and stakeholders to understand and formulate security requirements
• Define, maintain and enforce application security best practices
• Perform third-party library security assessments and dependency analysis
• Conduct vulnerability assessments and manual/automated code review of Java and Scala applications to find security vulnerabilities (CSRF, XSS, SQL injection, privilege escalation, etc.) and recommend remediation
• Analyze scan reports from SAST, DAST and SCA tools, interpret the issues and recommend remediation across a variety of applications, programming languages and platforms
• Conduct static, dynamic and penetration security testing of web applications and REST APIs
• Perform software security architecture and design reviews
• Write comprehensive reports with assessment findings, outcomes and recommendations for further security enhancement
• Identify and demonstrate vulnerabilities to application owners and recommend remediation
• Use scripting to integrate and automate security tools within DevOps CI/CD processes

• 3 years of experience in secure code review, specifically with languages such as Scala, Java, JavaScript and the Spring Framework
• 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST)
• 3+ years of hands-on manual penetration testing of web applications and REST APIs using BurpSuite Pro and Postman/Bruno
• Deep understanding of secure coding best practices and DevSecOps principles
• Proficiency with OWASP Top 10 and SANS 25 standards and testing guidelines
• Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS security principles, Jenkins and GitHub
• US citizenship

Preferred: GPEN, GWAPT, OSCP or CompTIA PenTest+ certification.