Ethical Hacker/Penetration Tester Principal

Cybersecurity Jobs; City of Albany (NY); Hybrid; USD 76,000 - 83,000; Full time

Job summary

sdna global in Albany, NY is seeking a Java application security lead to strengthen products through real-world testing, remediation guidance, and incident support. This hybrid role combines hands-on security work with secure development practices.

You will partner with development and testing teams, perform penetration testing and vulnerability assessments on Java applications, and help embed security into the SDLC.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 6+ years in a Development and/or Security (Dev Sec) role.
• Strong core Java coding experience and knowledge of Java security practices.
• Experience in Penetration Testing and/or Ethical Hacking focused on Java application security.
• Background as an engineer with Dev Sec on a large-scale public enterprise application.
• Scripting experience and strong problem-solving and analytical skills.
• Web application security principles (OWASP) and common vulnerabilities such as SQL injection and XSS.
• Penetration testing tooling experience, including Burp Suite and Metasploit.
• Familiarity with Fortify on Demand (SAST and DAST tools).
• Strong understanding of cryptography and SSL/TLS.

Responsibilities

• Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure.
• Find weaknesses in Java code using automated and manual techniques.
• Build and use custom exploits to validate application security and simulate attacker tactics.
• Partner with Development teams to understand application architecture and surface security gaps early.
• Work with Testing teams to integrate security checks into both manual and automation testing.
• Provide secure coding guidance, including how to fix vulnerabilities.
• Stay current on Java security threats and best practices, and help strengthen secure development processes (SDLC).
• Support security incidents tied to Java vulnerabilities, including issues aligned to current published NIST CVE.
• Document and report findings with technical details, risk assessment, and recommended solutions.
• Communicate recommendations to technical and non-technical audiences.
• Contribute to security policies covering Java development and deployment.
• Explore penetration avenues by manipulating URLs, query parameters, and application browser data.
• Validate and assess browser tokens, including cache manipulation, and evaluate production vs non-production architecture.
• Apply MITRE ATT&CK Framework familiarity in testing and validation work.

Skills

6+ years DevSec experience

Excellent communication

Scripting experience

Cryptography knowledge

Core Java knowledge

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Burp Suite

Metasploit

Fortify on Demand

OWASP

Job description

sdna global is hiring a Java application security lead to strengthen products through real-world testing, clear remediation guidance, and incident support. This Ethical Hacker/Penetration Tester Principal role is hybrid in Albany, NY, with travel to Albany twice per month. You will help teams reduce risk across the SDLC by combining hands-on penetration testing with secure coding and vulnerability response.

What you’ll do

• Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure.
• Find weaknesses in Java code using automated and manual techniques.
• Build and use custom exploits to validate application security and simulate attacker tactics.
• Partner with Development teams to understand application architecture and surface security gaps early.
• Work with Testing teams to integrate security checks into both manual and automation testing.
• Provide secure coding guidance, including how to fix vulnerabilities.
• Stay current on Java security threats and best practices, and help strengthen secure development processes (SDLC).
• Support security incidents tied to Java vulnerabilities, including issues aligned to current published NIST CVE.
• Document and report findings with technical details, risk assessment, and recommended solutions.
• Communicate recommendations to technical and non-technical audiences.
• Contribute to security policies covering Java development and deployment.
• Explore penetration avenues by manipulating URLs, query parameters, and application browser data.
• Validate and assess browser tokens, including cache manipulation, and evaluate production vs non-production architecture.
• Apply MITRE ATT&CK Framework familiarity in testing and validation work.

What you’ll bring

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 6+ years in a Development and/or Security (Dev Sec) role.
• Strong core Java coding experience and knowledge of Java security practices.
• Experience in Penetration Testing and/or Ethical Hacking with a focus on Java application security.
• Background as an engineer and in Dev Sec work on a large-scale public enterprise application.
• Scripting experience and strong problem-solving and analytical skills.
• Web application security principles (including OWASP) and knowledge of common vulnerabilities such as SQL injection and XSS.
• Penetration testing tooling experience, including Burp Suite and Metasploit.
• Familiarity with Fortify on Demand (SAST and DAST tools).
• Strong understanding of cryptography and secure communication protocols such as SSL/TLS.
• Excellent communication skills and the ability to maintain confidentiality with high ethical standards.

Tools and technologies you’ll work with

• Java, Burp Suite, Metasploit
• Fortify on Demand, OWASP
• SQL injection, XSS
• SSL/TLS, MITRE ATT&CK Framework, NIST CVE

Preferred qualifications

• Security certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or other industry security certifications.
• Experience with scripting languages such as Python and Bash.
• Experience with secure code review for Java.
• Familiarity with cloud security testing.
• Experience with mobile application penetration testing.
• Knowledge of regulations such as HIPAA.
• Experience with API testing.

Compensation: USD 55-60 per hour.