Contract Vulnerability QA Tester — Web & Mobile Security

Two95 International Inc.; Washington (District of Columbia); On-site; USD 55,000 - 96,000; Full time

Job summary

Two95 International Inc. is seeking a QA Tester in Washington, DC for a contract position focused on identifying vulnerabilities across web services, applications, APIs, and mobile apps.

The role includes managing vulnerability testing tools and coordinating remediation with third parties and stakeholders. The candidate will run patch/configuration audits, maintain asset inventories, and ensure data protection checks for PII/PCI at rest using CheckMarx, WebInspect, Nmap, Metasploit, and Nessus.

Qualifications

• Analyze scan data, remove false positives, and support remediation efforts.
• Coordinate scan efforts with third parties, submit internal and external scan requests and obtain approvals.
• Conduct follow-up meetings with stakeholders, and provide support on remediation efforts.
• Experience in vulnerability testing tool management and administration.
• Experience with OS, web application and mobile app vulnerability testing.

Responsibilities

• Test web services, web applications, APIs, and mobile apps for vulnerabilities.
• Perform patch/configuration audit scans and create scan reports.
• Periodically run Host Discovery Scans and maintain an accurate inventory.
• Use commercial tools to check PII/PCI data at rest.

Skills

Vulnerability testing

Remediation coordination

Stakeholder communication

Tools

CheckMarx

Client WebInspect

Nmap

Metasploit

Nessus Security Center

Job description

Two95 International Inc. is seeking a QA Tester in Washington, DC for a contract position focused on identifying vulnerabilities across web services, applications, APIs, and mobile apps.

The role includes managing vulnerability testing tools and coordinating remediation with third parties and stakeholders. The candidate will run patch/configuration audits, maintain asset inventories, and ensure data protection checks for PII/PCI at rest using CheckMarx, WebInspect, Nmap, Metasploit, and Nessus.