> Markdown version of [/jobs/ext/4010283-security-test-engineer](https://www.wearedevelopers.com/jobs/ext/4010283-security-test-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Test Engineer

- **Company:** Ova Technologies
- **Location:** New York, NY, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Software System Penetration Testing, JIRA, User Authentication, Bash Shell, Burp Suite, Databases, Continuous Integration, Cross-Site Request Forgery, Data Validation, Database Security, DevOps, Mobile Application Software, JSON, Python (Programming Language), Nmap, OAuth, Open Web Application Security, Systems Development Life Cycle, Role-Based Access Control, Fortify (Software), Standard Sql, Web Application Security, Security Software, Selenium, Session Management, SonarQube, SQL Injection, Test Data, Tripwire, Wireshark, Web Applications, Extensible Markup Language (XML), Enterprise Software Applications, Postman, Software Security, SOAPAPI, Cross-Site Scripting (XSS), Rate Limiting, Git, Metasploit, Playwright, Nessus, Checkmarx, Restful APIs, Devsecops, Docker, Security Orchestration, Automation & Response, Jenkins, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing
- **Published:** October 29, 2026
- **Apply:** https://www.thejobnetwork.com/job/5a2dd127-199d-4c94-ba40-5bac2f306b87/security-test-engineer

## About the Role

Good understanding of:

 * Secure SDLC
 * CI/CD
 * SAST
 * DAST
 * SCA
 * Container security
 * Dependency vulnerability scanning
 * Secrets scanning
 * Security gates
 * Docker/Kubernetes security basics

Certifications Good to Have

 * Security
 * CEH
 * eJPT
 * OSCP advanced penetration testing
 * CISSP generally for experienced security professionals

Experience Experience Typical Role 0 2 years Junior Security Test Engineer 2 5 years Security Test Engineer 5 8 years Senior Security Test Engineer 8 years Security Testing Lead / Security Architect Resume Keywords

Security Testing | Application Security | Web Security | API Security | OWASP | OWASP Top 10 | Burp Suite | OWASP ZAP | SQL Injection | XSS | CSRF | IDOR | Authentication | Authorization | JWT | OAuth | SAST | DAST | SCA | DevSecOps | CI/CD | Vulnerability Assessment | Penetration Testing | REST API | Postman | Python | Java | Git | Jenkins

## Description

We are looking for a Security Test Engineer to identify, validate, and report security vulnerabilities in web applications, APIs, mobile applications, and enterprise systems. The role involves security testing throughout the SDLC and working with development, QA, DevOps, and security teams to improve application security., * Analyze requirements and identify security testing scenarios.

 * Create security test plans, test cases, and test data.
 * Perform Web Application Security Testing.
 * Perform API Security Testing.
 * Perform mobile application security testing when required.
 * Identify vulnerabilities such as:
 + SQL Injection
 + Cross-Site Scripting (XSS)
 + Cross-Site Request Forgery (CSRF)
 + Broken Authentication
 + Broken Authorization
 + IDOR
 + Session management issues
 + Security misconfiguration
 + Sensitive data exposure
 + File-upload vulnerabilities
 * Perform authentication and authorization testing.
 * Validate role-based access control (RBAC).
 * Test JWT, OAuth, cookies, sessions, and access tokens.
 * Perform vulnerability scanning and security assessments.
 * Analyze application logs and security findings.
 * Reproduce and validate reported vulnerabilities.
 * Perform regression security testing after vulnerabilities are fixed.
 * Collaborate with developers to understand and remediate security defects.
 * Prepare security test reports and vulnerability documentation.
 * Participate in threat modeling and risk assessment.
 * Integrate security testing into CI/CD pipelines.
 * Track vulnerabilities using JIRA or security-management tools.
 * Follow OWASP and organizational security standards.

Security Testing Areas

 1. Authentication
 * Valid/invalid credentials
 * Password policy
 * Account lockout
 * MFA
 * Session timeout
 * Password reset
 * Token expiration

 2. Authorization
 * Horizontal privilege escalation
 * Vertical privilege escalation
 * Role-based access
 * Unauthorized API access
 * IDOR

 3. Input Validation
 * SQL Injection
 * XSS
 * Command injection
 * Path traversal
 * Malicious file uploads

 4. API Security
 * Authentication
 * Authorization
 * Token validation
 * Rate limiting
 * Input validation
 * Sensitive information exposure
 * API abuse scenarios

Tools

Common tools include:

 * Burp Suite
 * OWASP ZAP
 * Postman
 * Nessus
 * Nmap
 * Wireshark
 * Metasploit
 * SonarQube
 * Snyk
 * Trivy
 * Checkmarx
 * Fortify

Automation / Programming

Knowledge of one or more:

 * Java
 * Python
 * JavaScript
 * Selenium / Playwright
 * REST Assured
 * Bash/Shell scripting

Security automation can include:

CI/CD Security Scan Automated Security Tests Vulnerability Report Quality/Security Gate Deployment

API & Database Skills

 * REST/SOAP APIs
 * HTTP/HTTPS
 * JSON/XML
 * HTTP headers
 * Cookies
 * JWT
 * OAuth 2.0
 * SQL
 * Database security basics