Application Penetration Tester

ASM Research•Remote,

10d

About The Position

The Application Security Penetration Tester safeguards web applications and REST APIs by identifying and helping remediate security vulnerabilities. The role conducts security assessments of third-party libraries and dependencies, automated and manual code reviews, vulnerability assessments, and static, dynamic, and penetration testing. It evaluates issues such as CSRF, XSS, SQL injection, and privilege escalation, recommends remediation, and produces comprehensive reports with findings and security improvement proposals. The position works with development teams and stakeholders to formulate and communicate security requirements, define and enforce application security best practices, and integrate security into the software development lifecycle through architecture and design reviews. It also analyzes SAST, DAST, and SCA scan reports and uses scripting to integrate and automate security tools within DevOps CI/CD processes.

Requirements

At least 3 years of secure code review experience, specifically with Scala, Java, JavaScript, and the Spring Framework.
At least 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST).
At least 3 years of hands-on manual penetration testing of web applications and REST APIs using BurpSuite Pro and Postman or Bruno.
Deep understanding of secure coding best practices and DevSecOps principles.
Proficiency in OWASP Top 10 and SANS 25 standards and testing guidelines.
Knowledge of CI/CD, AWS security principles, Jenkins, and GitHub.
Knowledge of scripting languages for integrating and automating security tools within DevOps CI/CD processes.

Nice To Haves

GPEN, GWAPT, OSCP, or CompTIA PenTest+ certification.

Responsibilities

Liaise with development teams and stakeholders to understand and formulate security requirements.
Define, maintain, and enforce application security best practices.
Assess the security of third-party libraries and analyze dependencies.
Conduct vulnerability assessments and manual and automated code reviews of Java and Scala applications.
Identify vulnerabilities such as CSRF, XSS, SQL injection, and privilege escalation, and recommend remediation.
Analyze SAST, DAST, and SCA scan reports, interpret issues, and recommend remediation across applications, languages, and platforms.
Conduct static, dynamic, and penetration security testing of web applications and REST APIs.
Perform software security architecture and design reviews.
Write comprehensive reports documenting findings, outcomes, and recommendations for improving system security.
Identify and demonstrate vulnerabilities to application owners and recommend remediation.
Use scripting to integrate and automate security tools within DevOps CI/CD processes.