Application Security & Compliance Pen Tester (Hybrid)

nc; North Carolina; Hybrid; USD 88,000 - 117,000; Full time

Job summary

North Carolina DHHS IT Division is seeking an IT Security & Compliance Specialist II (NS) to identify and mitigate vulnerabilities across web apps, APIs, and mobile platforms. The role emphasizes secure coding practices from design through deployment and collaboration with DevOps and engineering teams.

The position requires hands-on testing using industry tools, extensive vulnerability documentation, and experience with CI/CD security enhancements within a hybrid work model based in Raleigh, NC.

Qualifications

• Hands-on experience performing manual penetration testing of web applications, REST and GraphQL APIs, and mobile apps.
• Ability to identify, exploit, validate, and document vulnerabilities including SQLi, XSS, SSRF, auth flaws.
• Proficient in manual and automated security assessments using Burp Suite, ZAP, Nmap, Metasploit, Nessus, Snyk, Veracode and Checkmarx.

Responsibilities

• Identify, analyze, and mitigate vulnerabilities in software applications and APIs across the development lifecycle.
• Collaborate with developers to triage, prioritize, and remediate findings; work with DevOps for secure deployment.
• Integrate security controls and automated testing into CI/CD to support DevSecOps initiatives.
• Produce comprehensive technical assessment reports with PoCs and attack scenarios.

Skills

Penetration testing

Secure coding

SAST/DAST

OWASP

CI/CD security

Vulnerability reporting

Education

Bachelor's degree in computer science or related IT field

Associate degree in related IT field

Equivalent combination of education and experience

Tools

Burp Suite

OWASP ZAP

Nmap

Metasploit

Nessus

Snyk

Veracode

Checkmarx

Job description

North Carolina DHHS IT Division is seeking an IT Security & Compliance Specialist II (NS) to identify and mitigate vulnerabilities across web apps, APIs, and mobile platforms. The role emphasizes secure coding practices from design through deployment and collaboration with DevOps and engineering teams.

The position requires hands-on testing using industry tools, extensive vulnerability documentation, and experience with CI/CD security enhancements within a hybrid work model based in Raleigh, NC.