Senior Application Penetration Tester
San Jose, California (Remote Positions Available)
AppSec Consulting has an immediate opening for a Senior Application Penetration Tester to join our growing consulting company. This regular, full-time position is a great opportunity for someone with strong web and/or mobile application development and security skills. This is a highly technical hands-on role that will utilize your development skills but involves little coding.
We have plenty of interesting projects to work on, including security assessments of a wide variety of web applications (financial, e-commerce, gaming, etc.), web services, mobile applications, and more. This is an opportunity for a team player who would like to work with a world-class team, is ready to get started quickly, and is eager to learn some new skills and have fun while doing so.
Primary Job Duties
- Conducting application security assessments and penetration tests (web, mobile, web service, etc.). These assessments involve manual testing and analysis as well as the use of automated application vulnerability scanning/testing tools such as Burp Suite Professional and/or code review tools such as HP Fortify or Checkmarx. We expect you to have experience doing similar assessments, but we will train you on our proprietary assessment methodology.
- Writing a formal security assessment report for each application, using our company’s standard reporting format.
- Participating in conference calls with clients to review your assessment results and consult with the clients on remediation options.
- Retesting security vulnerabilities that have been fixed and republishing your report to indicate the results of your retesting.
- Participating in conference calls with potential clients to scope out newly requested security projects and estimate the amount of time required to complete the project.
Occasional Job Duties
- Leading other application security related projects, such as helping customers build security into their software development life cycles, configuring and tuning web application firewalls, performing application security design reviews, etc.
- Delivering classroom training on Secure Application Development and Application Security Testing (and assisting with enhancements to our training materials).
- Providing on-the-job training and mentoring to other members of the team.
- Assisting with security assessment and reporting methodology enhancements.
Our company is headquartered in San Jose, California. However the right candidate for this position can perform most work remotely from anywhere. Some of the work will involve travel, but not much.
- Several years of experience developing web and/or mobile applications, preferably hard-core financial, e-commerce, or business applications that face the Internet. (required)
- Knowledge of the HTTP protocol and how it works.
- Experience performing application security testing using manual techniques plus runtime vulnerability testing tools and/or code review tools.
- Experience with network/infrastructure-level penetration testing (nice to have, but not necessary)
- Honesty and integrity.
- Solid written and verbal communication skills.
- Willingness to do hands-on, highly technical work.
- Strong customer focus. The goal should be to make customers happy enough that they ask for you to be called back to do more work for them.
- Desire to learn new things and be a participant in the local information security community.
- Flexibility to work odd hours at times. For the most part this is a Monday-Friday 8:00 to 5:00 job, but sometimes customers require us to do certain work during weekends or off-hours.
- Must undergo criminal background check and drug testing.
- Competitive salary including performance incentives
- Reasonable work hours compared with most information consulting firms. We expect employees to work hard and produce results, but we also understand that our employees have a life outside of work. A typical work week is 40 hours. Weekend work is rare and is rewarded with time off during the week.
- Company sponsored medical and dental insurance
- Company sponsored 401K with company match
- Company sponsored training programs and career growth opportunities. For example, most of the team goes to DEF CON every year.
- You’ll be part of a closely-knit team of dedicated employees.
If you think you’re the right person for this challenging and fun career opportunity, please send your resume to firstname.lastname@example.org .