Penetration Tester (Onsite in Dallas, TX) local only

Penetration Tester Web Applications

Overview We are looking for a Penetration Tester with two to five years of hands-on experience performing security assessments of web and mobile applications.

The role involves conducting end-to-end evaluations of applications and their supporting APIs, identifying exploitable weaknesses, and delivering clear, actionable remediation guidance to stakeholders at all levels.

Key Responsibilities

Execute penetration tests on web applications, mobile applications (iOS/Android), and APIs, including cloud-hosted services (AWS, Azure, Google Cloud Platform).

Perform threat modeling, exploitation, and post-exploitation activities to determine true business impact.

Assess technical and procedural security controls, validating configurations and identifying weaknesses in authentication, authorization, session

management, and data protection.

Develop and maintain custom scripts, payloads, and automation tools to enhance testing depth and efficiency.

Produce detailed technical reports with risk ratings, reproduction steps, and practical mitigation recommendations.

Deliver executive summaries and presentations that translate technical findings into business risk terms.

Collaborate with engineering, development, and security teams to support remediation and retesting efforts.

Stay informed on emerging vulnerabilities, exploits, and security frameworks, integrating new techniques into testing methodologies.

Contribute to the ongoing refinement of internal testing standards, playbooks, and templates.

Required Qualifications

2 5 years of professional experience in penetration testing, offensive security, or vulnerability research, with a focus on application security.

Strong knowledge of:

o Web application security (OWASP Top 10, API vulnerabilities, client-side attacks)

o Mobile application security (OWASP Mobile Top 10, reverse engineering, insecure data storage, certificate pinning bypass)

o Authentication and authorization flaws, session management issues, and business logic vulnerabilities

Proficiency with tools such as:

o Burp Suite, OWASP ZAP, Frida, MobSF, Postman, SQLmap, or equivalent frameworks

Scripting ability in Python, JavaScript, or Bash for custom exploitation or automation.

Familiarity with cloud security testing as it relates to application workloads (AWS IAM, Azure AD, containerized environments).

Excellent documentation and client-facing communication skills.

Preferred Certifications

OSCP, eWPT, eWPTX, BSCP, GWAPT, HTB CWEE, or similar offensive security certifications

Mobile-specific training or certifications are a plus

Core Competencies

Analytical and detail-driven with a strong understanding of risk prioritization

Skilled at translating technical findings into business impact

Adaptable and resourceful across varying application technologies and frameworks

Committed to continuous learning and professional development in cybersecurity