Penetration Tester

POSITION OVERVIEW • The Penetration Tester / Ethical Hacker is responsible for identifying, validating, exploiting, and supporting remediation of security vulnerabilities within large-scale Java applications. This is a hands-on technical role focused on application penetration testing and ethical hacking using real-world attack techniques. • The successful candidate will combine strong Java development/engineering knowledge with practical penetration testing experience and work closely with Development and Testing teams to identify vulnerabilities, validate exploitability, and strengthen application security. MINIMUM QUALIFICATIONS • Education: Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field. • Minimum 6 years of combined Development and/or Security experience. • Prior software engineering/development experience, including Core Java coding. • Hands-on Penetration Testing / Ethical Hacking experience focused on Java/J2EE application security. • Experience supporting a large-scale, public-facing enterprise application. • Experience working in a DevSec or application security environment. REQUIRED TECHNICAL / FUNCTIONAL SKILLS • Core Java programming and strong understanding of Java application architecture and security practices. • Hands-on web application penetration testing using manual and automated techniques. • Ability to validate and exploit vulnerabilities and create/modify proof-of-concept exploits. • Manipulation of URLs, query parameters, HTTP requests, browser data, tokens, sessions, and cache behavior. • OWASP-related vulnerabilities and exploitation techniques, including SQL injection, XSS, authentication and authorization weaknesses. • Hands-on use of Burp Suite and familiarity with Metasploit. • Familiarity with Fortify on Demand SAST/DAST and MITRE ATT&CK. • Understanding of cryptography and SSL/TLS. • Scripting experience supporting penetration testing and security analysis. • Ability to clearly document technical findings, exploitability, risk, evidence, and remediation. KEY RESPONSIBILITIES • Conduct hands-on penetration tests and vulnerability assessments of Java applications and supporting infrastructure. • Identify application security weaknesses using manual and automated techniques. • Simulate attacker techniques and develop or modify exploits to determine actual exploitability. • Analyze workflows, authentication, authorization, sessions, tokens, browser data, URLs, query parameters, and other attack surfaces. • Collaborate with Development teams to understand architecture, identify weaknesses, and provide remediation/secure coding guidance. • Collaborate with Testing teams to integrate security considerations into manual and automated testing. • Document findings, technical evidence, risk, business impact, and recommended corrective actions. • Validate remediation through follow-up testing and retesting. • Monitor relevant Java threats, vulnerabilities, and published NIST CVEs. • Support secure SDLC improvement and application security standards/practices. PREFERRED QUALIFICATIONS • OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or comparable certification. • Python, Bash, or other penetration-testing scripting experience. • Secure Java code review experience. • API penetration testing experience, including REST and/or SOAP. • Cloud security testing and/or mobile application penetration testing. • HIPAA or comparable regulated-environment knowledge. • SCA/SBOM experience identifying vulnerable third-party components. • AI-assisted security tools used to identify vulnerabilities or attack paths, with manual validation of exploitability. CANDIDATE PROFILE • Candidate should clearly explain a current/recent Java application they personally penetration tested, including application purpose and architecture. • Candidate should distinguish their individual role and the penetration testing activities they personally performed. • Candidate should provide specific examples of vulnerabilities personally identified, exploited, validated, documented, and retested. • Candidate should explain hands-on Burp Suite use rather than relying solely on automated scanning. • Candidate should demonstrate how Java development knowledge contributes to vulnerability identification and collaboration with Development. • Candidate should distinguish Hands-on Experience, Working Knowledge, and Exposure.