Application Penetration Tester

Royper Royco LLC; United States; Remote; USD 110,000 - 165,000; Full time

Job summary

Royper Royco LLC is seeking an Application Penetration Tester for a remote, US-based role focused on federal healthcare initiatives. You will perform SAST/DAST, manual and automated testing of web apps and REST APIs (Burp Suite), and help embed security testing into DevOps pipelines.

Responsibilities include translating findings into remediation guidance, reviewing architectures for weaknesses, and delivering detailed security assessment reports.

Qualifications

• > At least 3 years of practical experience with SAST and DAST.
• > 3+ years of hands-on manual penetration testing of web apps and REST APIs using Burp Suite Professional and Postman/Bruno.
• > Strong secure coding practices, DevSecOps, and application security principles.
• > Knowledge of OWASP Top 10 and SANS Top 25.
• > Familiarity with CI/CD, AWS security, Jenkins, and GitHub.
• > Ability to communicate risks clearly and provide remediation guidance.
• > US citizenship and ability to pass a federal background check.
• > Preferred GPEN, GWAPT, OSCP, or PenTest+.

Responsibilities

• Collaborate with developers to translate security requirements into practical measures.
• Promote application security best practices aligned with industry standards.
• Assess third‑party libraries and dependencies for risks.
• Conduct secure code reviews of Java/Scala apps for CSRF, XSS, SQLi, and privilege escalation.
• Analyze SAST/DAST/SCA results and provide actionable remediation recommendations.
• Perform static, dynamic, and manual pen testing of web apps and REST APIs (Burp Suite focus).
• Review security architecture and designs to identify weaknesses and improvements.
• Prepare comprehensive assessment reports with findings, risk levels, and remediation steps.
• Demonstrate vulnerabilities to owners and guide remediations.
• Develop scripts and integrate security testing into DevOps/CI‑CD pipelines.

Skills

Application security

Penetration testing

SAST/DAST

Burp Suite

CI/CD

Tools

Burp Suite Professional

Postman

Bruno

Jenkins

GitHub

AWS security

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Penetration Tester based in the United States.

Using industry-leading tools and frameworks, you will help development teams address security risks and implement robust security practices. You will also contribute to integrating automated security testing into DevOps and CI/CD pipelines. This is an opportunity to make a meaningful impact on application security in a mission-critical federal environment.

Accountabilities:

• Collaborate with development teams and stakeholders to identify, define, and translate security requirements into practical application security measures.
• Establish, maintain, and promote application security best practices, ensuring alignment with recognized industry standards.
• Assess the security of third-party libraries, software components, and dependencies to identify potential risks.
• Conduct manual and automated secure code reviews of Java and Scala applications, identifying vulnerabilities such as Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL injection, and privilege escalation, and recommending appropriate remediation strategies.
• Analyze and interpret findings from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools, providing actionable recommendations across different applications, languages, and platforms.
• Perform static, dynamic, and manual penetration testing of web applications and REST APIs, primarily using Burp Suite.
• Review software security architecture and application designs to identify weaknesses and recommend improvements.
• Prepare comprehensive security assessment reports documenting vulnerabilities, findings, risk levels, test outcomes, and remediation recommendations.
• Demonstrate identified vulnerabilities to application owners and guide technical teams toward effective security remediation.
• Develop scripts and integrate security tools into DevOps and CI/CD pipelines to automate application security testing and improve development workflows.

Requirements:

• At least 3 years of practical experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• 3+ years of hands-on experience conducting manual penetration testing of web applications and REST APIs using Burp Suite Professional and tools such as Postman or Bruno.
• Strong understanding of secure coding practices, application security principles, and DevSecOps methodologies.
• In-depth knowledge of the OWASP Top 10 and SANS Top 25, including their associated security risks and testing guidelines.
• Familiarity with CI/CD processes, AWS security principles, Jenkins, and GitHub.
• Ability to analyze complex security findings, communicate technical risks clearly, and provide practical remediation guidance to development teams and stakeholders.
• Strong analytical, problem-solving, communication, and technical documentation skills.
• Must be a U.S. citizen and able to successfully pass a federal background investigation to obtain access to sensitive information.
• Preferred certifications include GPEN, GWAPT, OSCP, or CompTIA PenTest+.
• Full-time, fully remote work arrangement within the United States.
• Opportunity to contribute to application security initiatives within a federal healthcare program.
• Hands-on experience with industry-standard penetration testing tools, security frameworks, and DevSecOps technologies.
• Opportunity to collaborate with development, security, and technical stakeholders on meaningful cybersecurity challenges.
• Exposure to enterprise application security, vulnerability management, and automated security testing practices.