Senior Penetration Tester

Forward Financing•Boston, MA

2d•$145,000 - $183,000•Remote

About The Position

Forward Financing is seeking a Senior Penetration Tester to identify vulnerabilities in its software and AI systems before attackers do. The role includes testing core systems as well as AI systems and agents, and helping define how the company tests software developed with AI. The security organization is growing, giving the role influence over testing standards, tooling, and security practices for AI-built software. The Senior Penetration Tester will conduct manual penetration tests and build AI-assisted tooling and automation to expand test coverage. The role will also involve testing LLM applications, agents, and agent-generated code; triaging and remediating valid SAST findings; conducting secure code reviews across web applications, APIs, and AWS infrastructure; and building security tools and services within the application stack. The person will support security reviews of AI-built work before production, and communicate risks and remediation priorities to engineers. Forward Financing is a remote-first company. Employees may choose to work from home, an office, or a combination of both, and have flexible hours. Employees are also welcome to work from the company’s office locations for in-person collaboration.

Requirements

At least 5 years of experience in application security, offensive security, or product security.
Hands-on penetration testing and code-review experience across web applications, APIs, and AWS cloud infrastructure.
Curiosity about how systems fail and willingness to investigate beyond automated scanner results.
Interest in using AI to solve problems in personal workflows or in systems under test.
Understanding of AI/LLM attack surfaces, including prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code.
Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, and with secure SDLC practices.
Ability to communicate risk and priorities to security and software engineers.
Bachelor’s degree in Computer Science or an equivalent technical degree, or equivalent industry experience.

Nice To Haves

Experience penetration testing or red-teaming LLM applications and agentic systems.
OSCP, OSWE, or comparable offensive security certifications.
Experience contributing to bug-bounty or external testing programs.
Background in fintech or other regulated environments.

Responsibilities

Conduct manual penetration tests against company systems and build AI-assisted tooling and automation to extend test coverage.
Develop and implement approaches for testing LLM applications, agents, and agent-generated code.
Triage findings from SAST tools, remediate genuine vulnerabilities, and tune rules to reduce false positives.
Perform secure code reviews across web applications, APIs, and AWS infrastructure.
Build tooling and security services within the Forward application stack, including AI-assisted tools for the security team.
Support the test-to-production review process by ensuring AI-built work receives security review before promotion.
Explain security risks and findings to engineers so they can prioritize and implement fixes.