Collaborate with development teams and stakeholders to identify, define, and translate security requirements into practical application security measures.
Establish, maintain, and promote application security best practices, ensuring alignment with recognized industry standards.
Assess the security of third-party libraries, software components, and dependencies to identify potential risks.
Conduct manual and automated secure code reviews of Java and Scala applications, identifying vulnerabilities such as Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL injection, and privilege escalation, and recommending appropriate remediation strategies.
Analyze and interpret findings from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools, providing actionable recommendations across different applications, languages, and platforms.
Perform static, dynamic, and manual penetration testing of web applications and REST APIs, primarily using Burp Suite.
Review software security architecture and application designs to identify weaknesses and recommend improvements.
Prepare comprehensive security assessment reports documenting vulnerabilities, findings, risk levels, test outcomes, and remediation recommendations.
Demonstrate identified vulnerabilities to application owners and guide technical teams toward effective security remediation.
Develop scripts and integrate security tools into DevOps and CI/CD pipelines to automate application security testing and improve development workflows.
Requirements
At least 3 years of professional experience in secure code review, particularly with Java, Scala, JavaScript, and the Spring Framework.
At least 3 years of practical experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
3+ years of hands-on experience conducting manual penetration testing of web applications and REST APIs using Burp Suite Professional and tools such as Postman or Bruno.
Strong understanding of secure coding practices, application security principles, and DevSecOps methodologies.
In-depth knowledge of the OWASP Top 10 and SANS Top 25, including their associated security risks and testing guidelines.
Familiarity with CI/CD processes, AWS security principles, Jenkins, and GitHub.
Ability to analyze complex security findings, communicate technical risks clearly, and provide practical remediation guidance to development teams and stakeholders.
Strong analytical, problem-solving, communication, and technical documentation skills.
Must be a U.S. citizen and able to successfully pass a federal background investigation to obtain access to sensitive information.
Preferred certifications include GPEN, GWAPT, OSCP, or CompTIA PenTest+.
Benefits
Annual salary: $109,600–$137,000.
Full-time, fully remote work arrangement within the United States.
Opportunity to contribute to application security initiatives within a federal healthcare program.
Hands-on experience with industry-standard penetration testing tools, security frameworks, and DevSecOps technologies.
Opportunity to collaborate with development, security, and technical stakeholders on meaningful cybersecurity challenges.
Exposure to enterprise application security, vulnerability management, and automated security testing practices.
How Jobgether works
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
#LI-CL1
Ready to apply for Application Penetration Tester?
Opens Jobgether’s official Lever application page in a new tab. No TargetQA account required.
