Hands-On App Security Pen Tester (Web & API)

OnDefend LLC; Jacksonville (FL); Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical/dental/vision coverage

Short-term disability

Employee Assistance Program (EAP)

Job summary

OnDefend LLC, headquartered in Jacksonville, Florida, seeks an Application Penetration Tester who digs into applications, APIs, and supporting technologies to identify security weaknesses and help clients understand risks.

You will perform application security assessments using manual testing, source code review, and automated tools within defined engagement scopes, and communicate reproducible findings and practical remediation recommendations to both the team and clients.

Qualifications

• 3+ years of professional experience in application penetration testing or equivalent security work.
• Experience performing web application and API penetration tests within defined engagement scopes.
• Hands-on testing experience with vulnerabilities including authentication/authorization flaws, IDOR/BOLA, injection, and business logic issues.
• Working knowledge of HTTP, APIs, modern application architectures, and common security weaknesses.
• Proficiency with Burp Suite or comparable tools and ability to use PoC code.
• Familiarity with SAST, DAST, and SCA tools and understanding when manual validation is needed.
• Clear technical writing, attention to detail, and ability to document reproducible findings and collaborate with clients.

Responsibilities

• Execute penetration tests of web applications, APIs, backend services, and related technologies across client environments.
• Assess cloud environments for IAM weaknesses, misconfigurations, and privilege escalation paths.
• Work independently and collaborate with other testers on larger engagements.
• Test authentication, authorization, business logic, session management, input validation, and data handling.
• Review application behavior, architecture, source code, and data flows to identify vulnerabilities.
• Use SAST, DAST, SCA tools and manually validate findings.
• Develop or adapt proof-of-concept scripts to demonstrate vulnerabilities.
• Validate findings, capture reproducible evidence, and prepare clear reports with remediation recommendations.
• Maintain accurate testing notes and follow engagement scope and procedures.

Skills

Penetration testing

Web/API testing

Burp Suite

Manual testing

SAST/DAST/SCA

Cloud security

Technical writing

Tools

Burp Suite

Semgrep

Job description

OnDefend LLC, headquartered in Jacksonville, Florida, seeks an Application Penetration Tester who digs into applications, APIs, and supporting technologies to identify security weaknesses and help clients understand risks.

You will perform application security assessments using manual testing, source code review, and automated tools within defined engagement scopes, and communicate reproducible findings and practical remediation recommendations to both the team and clients.