Lead Web Application Penetration Tester

GDH; Charlotte (NC); On-site; USD 76,000 - 83,000; Full time

Job summary

GDH in Charlotte, NC is seeking an experienced security tester to lead advanced web application and API assessments. You will perform comprehensive penetration testing to identify vulnerabilities in authentication, authorization, session management, and business workflows.

You will employ manual and automated techniques using Burp Suite and OWASP tooling, map endpoints, and deliver actionable remediation guidance to developers and stakeholders.

Qualifications

• Proven experience in web application penetration testing.
• Strong knowledge of OWASP Top 10 and API security.
• Experience with REST and GraphQL testing.
• Ability to analyze authentication, authorization, and session management.
• Excellent report writing and remediation advisory skills.

Responsibilities

• Lead and execute penetration tests of web apps and APIs.
• Test complex business workflows such as onboarding and checkout.
• Use Burp Suite and OWASP tools for manual and automated assessments.
• Analyze API security including authorization, token handling and surface mapping.
• Provide remediation guidance to developers and stakeholders.

Skills

Penetration testing

API security

Report writing

Education

Security certifications or equivalent experience

Tools

Burp Suite

OWASP testing tools

Job description

Role Summary

This position involves leading advanced security assessments for modern web applications and APIs. The candidate will perform comprehensive penetration testing to identify vulnerabilities related to application logic, authentication, authorization, session management, and API security. The role requires a high level of technical expertise, manual testing skills, and experience with security tools to uncover high-impact risks in complex systems.

Responsibilities

• Lead and execute penetration tests targeting web applications, APIs, and associated services.
• Test complex business workflows such as user onboarding, checkout processes, account recovery, role escalation, and transaction handling.
• Conduct manual and automated security assessments using tools like Burp Suite, OWASP utilities, and other testing frameworks.
• Analyze API security, including object-level authorization, function-level controls, mass assignment, and broken references.
• Identify vulnerabilities in rate limiting, input validation, error handling, file uploads, and trust boundaries.
• Map applications and perform reconnaissance to identify endpoints, parameters, hidden functionality, and exposed surfaces.
• Test user roles, permissions, and privilege boundaries to identify privilege escalation issues.
• Probe session management, token handling, and session invalidation processes for weaknesses.
• Assess input handling for client-side and server-side validation issues, including edge cases and error-based disclosures.
• Provide remediation advice and security feedback to application owners, developers, and stakeholders.

Qualifications

• Proven experience in web application penetration testing.
• Proficiency with Burp Suite and related offensive security tools.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and GraphQL APIs.
• In-depth knowledge of authentication, authorization, session management, cookies, and tokens.
• Excellent report writing, communication, and remediation advisory skills.
• Ability to work independently and lead security assessments from planning to delivery.
• Knowledge of SAST, DAST, SCA, and API security tooling.
• Relevant education, training, certifications, or equivalent practical experience.

Publishing Pay Range

$55.00 – $60.00 USD Hourly

This position is based in office and requires employee to work on-site.