> Markdown version of [/jobs/ext/3981188-application-penetration-tester](https://www.wearedevelopers.com/jobs/ext/3981188-application-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Penetration Tester

- **Company:** DUNHILL PROFESSIONAL SEARCH
- **Location:** United States (Remote available)
- **Experience:** Experienced
- **Salary:** $109,600.0 - $137,000.0
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), Amazon Web Services, Software System Penetration Testing, Static Program Analysis, Code Review, Continuous Integration, Cross-Site Request Forgery, DevOps, Dynamic Program Analysis, Github, Spring Framework, Open Web Application Security, Comptia Pentest+ CE, Scala (Programming Language), Secure Coding, SQL Injection, Web Applications, Postman, Software Security, Cross-Site Scripting (XSS), GWAPT, Restful APIs, Burpsuite, Devsecops, Jenkins, Static Application Security Testing, Vulnerability Analysis, Programming Languages, Dynamic Application Security Testing
- **Published:** October 28, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9267765/application-penetration-tester

## About the Role

* 3 years of experience in secure code review, specifically with languages such as Scala, Java, JavaScript and the Spring Framework
 * 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST)
 * 3+ years of hands-on manual penetration testing of web applications and REST APIs using BurpSuite Pro and Postman/Bruno
 * Deep understanding of secure coding best practices and DevSecOps principles
 * Proficiency with OWASP Top 10 and SANS 25 standards and testing guidelines
 * Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS security principles, Jenkins and GitHub
 * US citizenship

Preferred: GPEN, GWAPT, OSCP or CompTIA PenTest+ certification.

## Description

* Serve as a liaison between development teams and stakeholders to understand and formulate security requirements
 * Define, maintain and enforce application security best practices
 * Perform third-party library security assessments and dependency analysis
 * Conduct vulnerability assessments and manual/automated code review of Java and Scala applications to find security vulnerabilities (CSRF, XSS, SQL injection, privilege escalation, etc.) and recommend remediation
 * Analyze scan reports from SAST, DAST and SCA tools, interpret the issues and recommend remediation across a variety of applications, programming languages and platforms
 * Conduct static, dynamic and penetration security testing of web applications and REST APIs
 * Perform software security architecture and design reviews
 * Write comprehensive reports with assessment findings, outcomes and recommendations for further security enhancement
 * Identify and demonstrate vulnerabilities to application owners and recommend remediation
 * Use scripting to integrate and automate security tools within DevOps CI/CD processes