Application Penetration Tester

Dunhill Government Solutions is hiring an Application Penetration Tester to safeguard web applications and REST APIs on a federal health program. Guided by the OWASP Top 10 and SANS 25, you will assess third-party libraries and dependencies, run automated and manual code reviews, uncover vulnerabilities such as CSRF, XSS, SQL injection and privilege escalation, and recommend remediation. You will use BurpSuite as your primary instrument for dynamic and penetration testing, write comprehensive findings reports, act as a bridge between development teams and stakeholders on security requirements, and integrate and automate security tools within DevOps CI/CD processes. This is a fully remote (telework) role.

Responsibilities:

• Serve as a liaison between development teams and stakeholders to understand and formulate security requirements
• Define, maintain and enforce application security best practices
• Perform third-party library security assessments and dependency analysis
• Conduct vulnerability assessments and manual/automated code review of Java and Scala applications to find security vulnerabilities (CSRF, XSS, SQL injection, privilege escalation, etc.) and recommend remediation
• Analyze scan reports from SAST, DAST and SCA tools, interpret the issues and recommend remediation across a variety of applications, programming languages and platforms
• Conduct static, dynamic and penetration security testing of web applications and REST APIs
• Perform software security architecture and design reviews
• Write comprehensive reports with assessment findings, outcomes and recommendations for further security enhancement
• Identify and demonstrate vulnerabilities to application owners and recommend remediation
• Use scripting to integrate and automate security tools within DevOps CI/CD processes

Required qualifications:

• 3 years of experience in secure code review, specifically with languages such as Scala, Java, JavaScript and the Spring Framework
• 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST)
• 3+ years of hands-on manual penetration testing of web applications and REST APIs using BurpSuite Pro and Postman/Bruno
• Deep understanding of secure coding best practices and DevSecOps principles
• Proficiency with OWASP Top 10 and SANS 25 standards and testing guidelines
• Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS security principles, Jenkins and GitHub
• US citizenship

Preferred: GPEN, GWAPT, OSCP or CompTIA PenTest+ certification.

Location: Remote (telework), United States.

Compensation: $109,600 - $137,000 per year

US Citizenship and the ability to pass a federal background investigation in order to be granted access to sensitive information.

#cjpost