CYBER SECURITY - Penetration Tester – Web Applications

CYBER SECURITY pen testing- Junior resource - immediate start

Irving to Westlake, TX office is 20 min.

Westlake, texas, that is where office is. Irving is big hub of people.

Penetration Tester – Web Applications

Overview We are looking for a Penetration Tester with two to five years of hands-on experience performing security assessments of web and mobile applications.

The role involves conducting end-to-end evaluations of applications and their supporting APIs, identifying exploitable weaknesses, and delivering clear, actionable remediation guidance to stakeholders at all levels.

Key Responsibilities

• Execute penetration tests on web applications, mobile applications (iOS/Android), and APIs, including cloud-hosted services (AWS, Azure, Google Cloud Platform).
• Perform threat modeling, exploitation, and post-exploitation activities to determine true business impact.
• Assess technical and procedural security controls, validating configurations and identifying weaknesses in authentication, authorization, session

management, and data protection.

• Develop and maintain custom scripts, payloads, and automation tools to enhance testing depth and efficiency.
• Produce detailed technical reports with risk ratings, reproduction steps, and practical mitigation recommendations.
• Deliver executive summaries and presentations that translate technical findings into business risk terms.
• Collaborate with engineering, development, and security teams to support remediation and retesting efforts.
• Stay informed on emerging vulnerabilities, exploits, and security frameworks, integrating new techniques into testing methodologies.
• Contribute to the ongoing refinement of internal testing standards, playbooks, and templates.

Required Qualifications

• 2–5 years of professional experience in penetration testing, offensive security, or vulnerability research, with a focus on application security.
• Strong knowledge of:

o Web application security (OWASP Top 10, API vulnerabilities, client-side attacks)

o Mobile application security (OWASP Mobile Top 10, reverse engineering, insecure data storage, certificate pinning bypass)

o Authentication and authorization flaws, session management issues, and business logic vulnerabilities

• Proficiency with tools such as:

o Burp Suite, OWASP ZAP, Frida, MobSF, Postman, SQLmap, or equivalent frameworks

• Scripting ability in Python, JavaScript, or Bash for custom exploitation or automation.
• Familiarity with cloud security testing as it relates to application workloads (AWS IAM, Azure AD, containerized environments).
• Excellent documentation and client-facing communication skills.

Preferred Certifications

• OSCP, eWPT, eWPTX, BSCP, GWAPT, HTB CWEE, or similar offensive security certifications
• Mobile-specific training or certifications are a plus

Core Competencies

• Analytical and detail-driven with a strong understanding of risk prioritization