Penetration Tester

DataStaff, Inc.; City of Albany (NY); Híbrido; USD 110.000 - 170.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Medical, dental, and vision coverage

Paid vacation, sick, and holiday leave

401k program after 6 months

Descripción de la vacante

DataStaff Inc. is seeking a Penetration Tester focused on Java application security for a long-term contract opportunity in Albany, NY. The role is primarily remote with on-site attendance required for the first 3 weeks, then on-site 2 days per month.

You will identify, exploit and fix vulnerabilities in Java apps, and work with development and testing teams to improve security. The ideal candidate has 6+ years in a DevSec role, a Bachelor's in CS or InfoSec, and hands-on experience with Burp

Formación

• 6+ years in a DevSec role with focus on Java security.
• Experience in Penetration Testing/Ethical Hacking for Java apps.
• Strong knowledge of Java, web security, and scripting.
• Familiarity with OWASP and common vulnerabilities.

Responsabilidades

• Conduct penetration tests and vulnerability assessments for Java applications and infrastructure.
• Identify security flaws in Java code using automated and manual methods.
• Create and use custom exploits to test application security.
• Collaborate with Development teams to understand architecture and fix weaknesses.
• Collaborate with Testing teams to integrate manual and automated testing.
• Provide guidance on secure coding and how to fix vulnerabilities.
• Stay updated on Java security threats and best practices.
• Assist in responding to security incidents related to Java vulnerabilities.
• Document findings with risk assessments and recommended solutions.
• Communicate findings to technical and non-technical staff.
• Contribute to security policies for Java development and deployment.
• Familiar with MITRE ATT&CK Framework

Conocimientos

Java security

OWASP

Burp Suite

Metasploit

Python scripting

Security testing

Vulnerability assessment

Educación

Bachelor's degree in Computer Science or Information Security

Herramientas

Burp Suite

Metasploit

Fortify on Demand

Descripción del empleo

DataStaff Inc. is seeking a Penetration Tester for a long-term contract opportunity with one of our direct clients in Albany, NY

* This position is primarily remote, with on-site attendance required for the first 3 weeks. After the initial 3-week period, you will be required to be on-site 2 days per month.

Job Description:

A Penetration Tester with a focus on Java application security is sought to identify, exploit, and fix vulnerabilities in Java applications to guard against cyber threats.

Key Responsibilities:

• Conduct penetration tests and vulnerability assessments for Java applications and infrastructure.
• Identify security flaws in Java code using automated and manual methods.
• Create and use custom exploits to test application security, simulating attacker tactics.
• Collaborate with Development teams to understand application architecture and find security weaknesses early.
• Collaborate with Testing teams to integrate manual and automated testing.
• Provide guidance on secure coding and how to fix vulnerabilities.
• Stay updated on Java security threats and best practices.
• Assist in responding to security incidents related to Java vulnerabilities, current published NIST CVE.
• Clearly document and report findings, including technical details, risk assessment, and recommended solutions.
• Communicate findings and recommendations to both technical and non-technical staff.
• Contribute to security policies for Java development and deployment.
• Familiar with MITRE ATT&CK Framework

Basic Minimum Experience:

• Bachelor’s degree in a related software field with 6+ years in a DevSec role.
• Previous job background as an engineer and Dev Sec position on a large-scale public enterprise scale application.

Qualifications:

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Minimum of 6 years of Development/Security experience
• Experience in Penetration Testing/Ethical Hacking with a focus on Java application security.
• Strong knowledge of Java programming and its security practices, as well as scripting experience.
• Proficiency in web application security principles (e.g., OWASP).
• Knowledge of common web vulnerabilities (e.g., SQL injection, XSS) and exploit techniques.
• Experience with penetration testing tools like Burp Suite and Metasploit.
• Familiarity with Fortify on Demand SAST and DAST tools.
• Strong understanding of cryptography and secure communication protocols (e.g., SSL/TLS).
• Excellent problem-solving and analytical skills.
• High ethical standards and confidentiality.

Preferred Qualifications:

• Certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or other industry security certifications.
• Experience with scripting languages (e.g., Python, Bash).
• Experience with secure code review for Java.
• Familiarity with cloud security testing.
• Experience with mobile application penetration testing.
• Knowledge of regulations like HIPAA.
• Experience with API testing

This opportunity is available as a W2 position with a competitive benefits package. DataStaff offers medical, dental, and vision coverage options as well as paid vacation, sick, and holiday leave. As many of our opportunities are long-term, we also have a 401k program available for employees after 6 months of employment.