Senior Penetration Tester

Forward Financing•Boston, MA

1d•Remote

About The Position

Forward Financing is hiring a Senior Penetration Tester to identify vulnerabilities in its software before attackers do. The role covers the company’s core systems as well as AI systems and agents, and will help establish how security testing keeps pace with software developed with AI assistance. The successful candidate will conduct manual penetration tests and build AI-assisted tooling and automation to expand testing coverage. They will help define approaches to testing LLM applications, agents, and agent-generated code, and integrate effective methods into regular testing. The position also includes triaging static application security testing (SAST) findings, fixing genuine vulnerabilities, tuning rules to reduce false positives, and performing secure code reviews across web applications, APIs, and AWS infrastructure. The tester will build security tooling and services within Forward’s application stack, support security reviews of AI-built work before production, and communicate findings and risk clearly enough for engineers to prioritize and address them. The role offers influence over the company’s developing security program, testing standards, tooling, and approach to securing AI-built software. Forward Financing is a remote-first company. Employees may work from home, in an office, or in a combination of both, and have flexible hours. Employees are welcome to use the company’s office locations for in-person collaboration.

Requirements

At least 5 years of experience in application security, offensive security, or product security.
Hands-on penetration testing and code-review experience across web applications, APIs, and AWS cloud infrastructure.
Curiosity about how systems break and persistence in investigating issues beyond scanner results.
Interest in using AI to solve problems, both in personal workflows and in systems under test.
Understanding of AI/LLM attack surfaces, including prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code.
Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, and with secure SDLC practices.
Ability to communicate risk and priorities to security and software engineers.
Typically a bachelor’s degree in Computer Science or an equivalent technical degree, or equivalent industry experience.

Nice To Haves

Experience penetration testing or red-teaming LLM applications and agentic systems.
OSCP, OSWE, or comparable offensive security certifications.
Experience contributing to bug bounty or external testing programs.
Background in fintech or other regulated environments.

Responsibilities

Conduct manual penetration tests against the company’s systems and build AI-assisted tools and automation to extend test coverage.
Develop and implement approaches for testing LLM applications, agents, and agent-generated code.
Triage findings from SAST tools, fix confirmed vulnerabilities, and tune rules that produce false positives.
Perform secure code reviews across web applications, APIs, and AWS infrastructure.
Build tooling and security services within the company’s application stack, including AI-assisted tools for the security team.
Support the test-to-production review process by ensuring AI-built work receives security review before promotion.
Explain security risk and findings to engineers so they can prioritize and remediate them.