Security Researcher

AppGate; Bogotá; On-site; COP 60,000,000 - 110,000,000; Full time

Job summary

AppGate is seeking a hands-on penetration tester to audit web applications, networks, and code across multiple industries. You will perform in-depth assessments and collaborate with the team on client engagements, rarely working solo. You will also contribute to in‑house Python tools to aid testing.

Excellent written and spoken English is required; OSCP or OSWE are highly preferred. AWS penetration testing experience is valued.

Qualifications

• Capable of performing in-depth penetration tests (usually 2-3 week duration).
• Strong understanding of web application and/or network vulnerabilities and mitigation controls.
• Good attention to detail and ability to complete tasks by the deadline.
• Well organized and ability to work autonomously.
• Technical curiosity and self-starter.

Responsibilities

• Perform web application audits (common), network penetration tests (common), source code analysis (common), hardware assessments (less common), mobile penetration tests (common).
• Create detailed penetration test reports in English detailing steps taken and actionable remediation suggestions.
• Develop scripts/tools to demonstrate vulnerabilities with proof or test exploit scenarios.
• Hands-on approach with minimal automation to provide deep-dive results.
• Work with team members on client assessments; rarely a solo engagement.
• Contribute to in-house Python tools to aid the penetration testing process.

Skills

Penetration testing

Web app security

Network security

Code analysis

Python scripting

AWS testing

Tools

OSCP

OSWE

Job description

• Perform web application audits (common), network penetration tests (common), source code analysis (common), hardware assessments (less common), mobile penetration tests (common) across multiple industries and environments.
• Create detailed penetration test reports in the English language (detailing the steps that were taken to exploit the issues and provide actionable remediation suggestions).
• The ability to create/script tools and exploits during the engagement to demonstrate a vulnerability with proof or write meaningful test cases (to test all attack theories).
• Expect a hands‑on approach to penetration testing. Very little automation is used (we take very deep dives into our targets to provide the best results).
• Work with other team members on client assessments. We are a team and work best as a group. It is very rare to have a solo engagement.
• Contribute to in‑house written tools (Python) to aid in the penetration testing process.

Experience & Qualifications

• Capable of performing in‑depth penetration tests (usually 2-3 week duration)
• Strong understanding of web application and/or network vulnerabilities and mitigation controls
• Good attention to detail and ability to complete tasks by the deadline
• Well organized and ability to work autonomously
• Technical curiosity and self‑starter

Preferred:

• AWS penetration testing experience strongly preferred
• OSCP or OSWE certification highly preferred (demonstration of exploitation capabilities or equivalent expertise can be used as a substitute)
• Development experience highly desirable but not required
• For senior analysts, ability to quickly become familiar with Appgate processes and progress to leading assessments

Language: Intermediate-Advanced English (written and spoken)

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

Appgate is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class. In furtherance of Appgate's policy regarding affirmative action and equal employment opportunity, Appgate has developed a written affirmative action program. This program is available for review upon request by any applicant or employee during normal business hours by contacting the company's EEO Coordinator.