Security Consultant - Penetration Testing & DevSecOps

Capgemini • Dallas, TX

7d • $82,950 - $135,300 • Remote

About The Position

Capgemini is seeking a Senior Security Consultant focused on penetration testing and DevSecOps. This remote, US-based position conducts security assessments across applications, APIs, cloud environments, and CI/CD pipelines, while working with development and engineering teams to integrate security throughout the software development lifecycle. The role requires strong technical skills, a proactive security mindset, and the ability to communicate risks to technical and business stakeholders.

The consultant performs manual and automated offensive security testing, validates vulnerabilities and their business impact, and provides remediation guidance. The role also integrates security tools and controls into CI/CD processes, supports vulnerability management and security engineering, and advises stakeholders throughout the development lifecycle.

Requirements

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field.
• 5–8 years of hands-on cybersecurity experience.
• At least 3 years of experience conducting application and API penetration testing.
• Experience implementing or supporting DevSecOps initiatives in CI/CD environments.
• Strong understanding of web application security, API security, secure SDLC, OWASP Top 10, OWASP API Top 10, MITRE ATT&CK, threat modeling, and vulnerability management.
• Hands-on experience with Burp Suite Professional, Nmap, Nessus, Qualys or Tenable, Metasploit, Kali Linux, Checkmarx, Veracode, Snyk, SonarQube, and GitHub Actions, Azure DevOps, or Jenkins.
• Excellent communication, consulting, and stakeholder management skills.

Nice To Haves

• One or more certifications: OSCP (preferred), CRTO, PNPT, CEH, GWAPT, GPEN, CISSP, CCSP, Azure Security Engineer Associate, or AWS Security Specialty.
• Experience with container security, including Docker and Kubernetes.
• Experience conducting cloud penetration testing.
• Understanding of Infrastructure as Code, including Terraform and CloudFormation.
• Familiarity with Red Team methodologies and adversary simulation.
• Experience with AI/LLM security testing.
• Exposure to Zero Trust Architecture and Secure-by-Design principles.

Responsibilities

• Perform manual and automated penetration testing of web applications, APIs, mobile applications, cloud environments, and supporting infrastructure.
• Conduct reconnaissance, vulnerability discovery, exploitation, and post-exploitation using industry methodologies such as OWASP, PTES, NIST, and MITRE ATT&CK.
• Identify vulnerabilities, validate exploitability, assess business risk, and recommend actionable remediation.
• Assess microservices, containers, Kubernetes, and cloud-native applications.
• Develop proof-of-concepts demonstrating security weaknesses and attack paths.
• Prepare technical reports and executive summaries for customers and stakeholders.
• Integrate security controls and testing into CI/CD pipelines.
• Implement and manage SAST, DAST, SCA, IaC, container security, secrets detection, and API security testing solutions.
• Collaborate with development teams to remediate vulnerabilities and adopt secure coding practices.
• Participate in security architecture reviews, threat modeling, and secure design assessments.
• Automate security testing and compliance validation within DevOps toolchains.
• Develop security guardrails and policy-as-code capabilities.
• Perform vulnerability triage, risk prioritization, and remediation tracking.
• Support continuous security monitoring and risk assessment.
• Analyze emerging threats, attack techniques, and security trends to improve testing methodologies.
• Assist in developing security standards, procedures, and best practices.
• Work with engineering, cloud, and infrastructure teams to improve organizational security posture.
• Present findings and recommendations to developers, architects, engineering teams, and leadership.
• Provide security consulting throughout the software development lifecycle.

Benefits

• Paid time off based on employee grade, including 12–25 vacation days depending on grade, company-paid holidays, personal days, and sick leave.
• Medical, dental, and vision coverage, or provincial healthcare coordination in Canada.
• Retirement savings plans, such as a 401(k) in the U.S. or RRSP in Canada.
• Life and disability insurance.
• Employee assistance programs.
• Other benefits as provided by local policy and eligibility.
• The role may be eligible for variable incentives, bonuses, or commissions, depending on the position and applicable laws.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level