Web Application Penetration Tester

Job Description

Web Application Penetration Tester

Location: Pleasanton, CA (Onsite/Hybrid)

Duration: Contract (1 Year)

Role Overview

We are seeking a highly skilled Web Application Penetration Tester to perform in-depth security testing of mission-critical enterprise applications. This role is focused on manually identifying vulnerabilities, driving remediation efforts, and strengthening overall application security posture .

The ideal candidate is a hands-on security expert who can work closely with development teams, not only to uncover risks but also to ensure secure design and implementation. This is a technical, execution-driven role , requiring strong expertise in penetration testing, secure coding practices, and modern web application architectures.

Required Skills

- Strong hands-on experience in web application penetration testing (manual testing mandatory)

- Deep knowledge of OWASP Top 10 and common web security vulnerabilities

- Proven ability to identify, exploit, and recommend remediation for vulnerabilities

- Experience working with enterprise web applications and multi-tier architectures

- Proficiency in Java and Spring framework

- Strong experience with relational databases (Oracle preferred)

- Working knowledge of Linux and Windows environments

- Experience with security testing tools and frameworks

- Ability to write automation scripts for repeated security testing

- Experience conducting secure code reviews

- Strong analytical and problem-solving skills

- Ability to collaborate with cross-functional teams (Dev, QA, Business)

- Strong written and verbal communication skills

Preferred Skills

- Experience in regulated or enterprise environments

- Familiarity with secure SDLC practices

- Exposure to application architecture and secure design principles

- Experience mentoring teams on secure coding practices

- Knowledge of CI/CD pipelines and integrating security testing

- Understanding of project management and documentation practices

- Ability to translate technical security findings to non-technical stakeholders

- Experience with test case creation, functional testing, and debugging support