Ethical Hacker/Penetration Tester Principal

VGAI Solutions; City of Albany (NY); On-site; USD 120,000 - 190,000; Full time

Job summary

VGAI Solutions in New York is seeking an experienced DevSec professional to perform penetration testing and secure Java applications across enterprise-scale systems.

You will identify vulnerabilities, develop custom exploits, and guide secure coding practices, collaborating with development and QA teams. Strong knowledge of OWASP, cryptography, and the MITRE ATT&CK framework is required, with security certifications considered a plus.

Qualifications

• Bachelor's degree in CS, Info Sec, or related field.
• 6+ years Development/Security experience.
• Experience in Penetration Testing with focus on Java security.

Responsibilities

• Conduct penetration tests and vulnerability assessments for Java apps and infra.
• Identify security flaws in Java code using automated and manual methods.
• Create and use custom exploits to test application security.
• Collaborate with Dev teams to understand architecture and find weaknesses early.
• Work with Testing teams to integrate security with testing.
• Provide guidance on secure coding and remediation.
• Stay updated on Java security threats and best practices.
• Respond to security incidents related to Java vulnerabilities (NIST CVE).
• Document findings with risk, details, and solutions.
• Communicate findings to technical and non-technical staff.
• Contribute to security policies for Java development and deployment.
• Familiar with MITRE ATT&CK framework.

Skills

Penetration testing

Secure coding practices

Analytical thinking

Ethical standards

Education

Bachelor's degree in Computer Science or Information Security

Tools

Burp Suite

Metasploit

Fortify on Demand

OWASP

SSL/TLS

Python scripting

Bash scripting

MITRE ATT&CK

Job description

• Bachelor’s degree in a related software field with 6+ years in a Dev Sec role.
• Previous job background as an engineer and Dev Sec position on a large-scale public enterprise scale application.

Key Responsibilities:

• Conduct penetration tests and vulnerability assessments for Java applications and infrastructure.
• Identify security flaws in Java code using automated and manual methods.
• Create and use custom exploits to test application security, simulating attacker tactics.
• Collaborate with Development teams to understand application architecture and find security weaknesses early.
• Collaborate with Testing teams to integrate with manual and automation testing.
• Provide guidance on secure coding and how to fix vulnerabilities.
• Stay updated on Java security threats and best practices.
• Assist in responding to security incidents related to Java vulnerabilities, current published NIST CVE.
• Clearly document and report findings, including technical details, risk assessment, and recommended solutions.
• Communicate findings and recommendations to both technical and non-technical staff.
• Contribute to security policies for Java development and deployment.
• Familiar with MITRE ATT&CK Framework.

Qualifications:

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Minimum of 6 years of Development/Security experience
• Experience in Penetration Testing/Ethical Hacking with a focus on Java application security.
• Strong knowledge of Java programming and its security practices as well as scripting experience.
• Proficiency in web application security principles (e.g., OWASP).
• Knowledge of common web vulnerabilities (e.g., SQL injection, XSS) and exploit techniques.
• Experience with penetration testing tools like Burp Suite, Metasploit.
• Familiarity with Fortify on Demand SAST and DAST tools.
• Strong understanding of cryptography and secure communication protocols (e.g., SSL/TLS).
• Excellent problem-solving and analytical skills.
• High ethical standards and confidentiality.

Preferred Qualifications:

• Certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP or other industry security certifications.
• Experience with scripting languages (e.g., Python, Bash).
• Experience with secure code review for Java.
• Familiarity with cloud security testing.
• Experience with mobile application penetration testing.