Application Security Penetration Tester (Web & API)

ASM Research, An Accenture Federal Services Company; Helena (MT); On-site; USD 110,000 - 137,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company seeks an Application Security Penetration Tester to safeguard web apps and REST APIs. You will perform both automated and manual security testing, analyze SAST/DAST results, and craft remediation guidance for cross-functional teams.

You will bridge development and security stakeholders, define security requirements, and contribute to secure SDLC, CI/CD integration, and architecture reviews. Relevant certifications are a plus.

Qualifications

• 3+ years in secure code review (Scala, Java, JavaScript, Spring).
• 3+ years SAST/DAST experience.
• 3+ years manual penetration testing of web apps and REST APIs.
• Strong knowledge of OWASP Top 10 and SANS 25.
• Experience with CI/CD and DevSecOps principles.
• Certifications preferred: GPEN, GWAPT, OSCP, or PenTest+.

Responsibilities

• Bridge between developers and stakeholders to define security requirements.
• Lead security reviews of architectures and designs.
• Analyze scan reports (SAST/DAST/SCA) and recommend remediations.
• Perform dynamic, static, and manual penetration testing of apps and APIs.
• Document findings with actionable remediation steps.

Skills

Security requirements

Security best practices

OWASP Top 10 / SANS 25

Dependency analysis

BurpSuite

Vulnerability assessment

CI/CD / DevSecOps

Java/Scala security

Tools

BurpSuite Pro

Postman

Bruno

Jenkins

GitHub

Job description

ASM Research, An Accenture Federal Services Company seeks an Application Security Penetration Tester to safeguard web apps and REST APIs. You will perform both automated and manual security testing, analyze SAST/DAST results, and craft remediation guidance for cross-functional teams.

You will bridge development and security stakeholders, define security requirements, and contribute to secure SDLC, CI/CD integration, and architecture reviews. Relevant certifications are a plus.