Application Penetration Tester

OnDefend LLC

20d•$100,000 - $135,000

About The Position

OnDefend is seeking a hands-on Application Penetration Tester to identify security weaknesses in applications, APIs, and supporting technologies and help clients understand their risks. The role performs application security assessments using manual testing, source code review, and automated tools where appropriate. The tester works within defined engagement scopes, collaborates with other testers, documents reproducible findings, and communicates results clearly to colleagues and clients. OnDefend is a cybersecurity company focused on helping organizations identify, understand, and reduce risk through security testing, consulting, and technology-enabled services. Its work includes penetration testing, application and cloud security, red and purple team assessments, and continuous security validation. The team is distributed across the United States, with headquarters in Jacksonville, Florida.

Requirements

At least 3 years of professional experience in application penetration testing, offensive security, or equivalent application security work.
Experience performing web application and API penetration tests within defined engagement scopes.
Hands-on manual testing experience with common vulnerabilities, including authentication and authorization flaws, IDOR/BOLA, injection, and business logic issues.
Working knowledge of HTTP, APIs, modern application architectures, and common application security weaknesses.
Proficiency with Burp Suite or comparable web security testing tools and ability to use or adapt proof-of-concept code.
Ability to read and understand source code in one or more languages such as Python, Java, JavaScript/TypeScript, Go, C#, or similar.
Familiarity with SAST, DAST, and SCA tools and understanding of when manual validation is needed.
Clear technical writing, attention to detail, and ability to document reproducible findings and collaborate with clients and teammates.
Must be authorized to work in the United States; employment visa sponsorship is not available.

Nice To Haves

Experience testing cloud-hosted applications or services in AWS, Azure, or Google Cloud.
Experience with mobile applications, GraphQL APIs, microservices, serverless systems, or containerized environments.
Familiarity with cloud identity, service-to-service authorization, Docker, Kubernetes, or related technologies.
Experience with Semgrep or similar source-code analysis tools.
Relevant certifications such as OSCP/OSCP+, BSCP, GWAPT, GPEN, or similar.
Contributions to security research, CVEs, bug bounties, open-source projects, publications, or conferences.

Responsibilities

Execute penetration tests of web applications, APIs, backend services, and related technologies across diverse client environments.
Assess cloud environments for IAM weaknesses, service misconfigurations, and privilege escalation paths, including cases where application flaws may provide access to underlying cloud infrastructure.
Work independently on assigned testing tasks and collaborate with other testers on larger or more complex engagements.
Test authentication, authorization, business logic, session management, input validation, and sensitive data handling.
Review application behavior, architecture, source code, and data flows to identify security vulnerabilities.
Use SAST, DAST, SCA, and other appropriate tools, and manually investigate and validate potential findings.
Develop or adapt proof-of-concept scripts and lightweight tooling to demonstrate vulnerabilities when needed.
Validate findings, capture reproducible evidence, and prepare clear reports with practical remediation recommendations.
Maintain accurate testing notes and evidence, follow engagement scopes and testing procedures, and promptly communicate progress or blockers.
Participate in peer review, share technical knowledge, and continue developing application security testing skills.
Work with engagement leads and other team members to clarify testing requirements, priorities, and technical questions.