Penetration Tester

Bright Security Inc.; United States; Remote; USD 110,000 - 170,000; Full time

Benefits offered by this job

Remote-first work environment

Ownership over campaigns and go-to-MGT

Opportunity to shape Bright’s security

Direct collaboration with leadership &

Diverse, inclusive workplace

Job summary

Bright Security Inc. is seeking a curious, hands-on Penetration Tester for a full-time, remote role. You will identify and validate vulnerabilities in web apps, APIs, and business logic, using manual and automated techniques.

You will own assessments from scoping to reporting, providing remediation guidance and retesting. You will contribute to testing methodologies, tooling, and knowledge sharing, and may expand into cloud, mobile, red team, or AI security areas based on experience.

Qualifications

• Hands-on penetration testing experience in security assessments or bug hunting.
• Strong knowledge of web/API security and OWASP Top 10/ API Top 10.
• Ability to perform meaningful manual testing beyond automated tools.
• Independent worker with meticulous attention to detail and reporting skills.
• Excellent written and spoken English for customer-facing communication.

Responsibilities

• Perform thorough manual and automated penetration testing of web apps and APIs.
• Plan and execute assessments with minimal supervision.
• Test authentication, authorization, session management, and access control.
• Identify vulnerabilities through investigative testing beyond scanners.
• Develop and validate practical exploit proof-of-concept when appropriate.
• Produce clear, customer-ready findings and remediation guidance.
• Validate fixes through retesting and provide final reports.
• Contribute to testing methodologies, tooling, and knowledge sharing.
• Support testing in cloud, mobile, red team, and AI/LLM security as experienced.

Skills

Penetration testing

Vulnerability research

Bug hunting

Bug bounty work

Offensive security

Web security

API security

OWASP Top 10

OWASP API Security Top 10

Authentication

Authorization

Access control

Business logic vulnerabilities

Manual testing

Investigation & analysis

Documentation & reporting

Customer-facing communication

English writing & speaking

HTTP & APIs knowledge

Modern web architectures

Tools

None

Job description

Bright Security delivers an enterprise-grade, developer-centric DAST platform that helps organizations identify and remediate vulnerabilities early and continuously in the SDLC. The platform is widely used for security testing of web applications, APIs, business logic, and LLM-based solutions.By integrating security testing into development workflows, Bright enables security and engineering teams to identify vulnerabilities earlier, improve collaboration, and accelerate remediation.

About the product

The company is developing a SaaS product that empowers Application Security & Development teams to find and fix vulnerabilities iteratively at every step in the SDLC, without slowing them down.

Position

We are looking for a curious, thorough, and hands-on Penetration Tester to help identify and validate security risks in web applications, APIs, business logic, and other modern application environments. This is a full-time, remote role. You’ll use both manual and automated techniques, going beyond scanner results to investigate how applications behave, explore attack paths, and uncover vulnerabilities through creative, methodical testing.

You’ll own assessments from scoping through testing, evidence collection, risk assessment, and reporting. You’ll also provide practical remediation guidance and retest fixes, with a strong focus on the quality and depth of every assessment.

Key responsibilities:

• Performing thorough manual and automated penetration testing of web applications and APIs.
• Independently planning and executing assigned assessments with minimal supervision.
• Testing authentication, authorization, session management, access control, business logic, input handling, and API behavior.
• Identifying vulnerabilities through manual investigation, creative testing, and analysis beyond automated scanner output.
• Developing and validating practical proof-of-concept exploitation where appropriate.
• Producing clear, detailed, customer-ready penetration testing findings and reports.
• Providing practical remediation guidance and validating fixes through retesting.
• Contributing to testing methodologies, tooling, knowledge sharing, and continuous improvement.
• Supporting additional testing areas such as cloud, mobile, red team, and AI or LLM security depending on experience.

Qualifications:

• Demonstrable hands-on experience with penetration testing, vulnerability research, bug hunting, bug bounty work, or comparable offensive security activities.
• Strong practical knowledge of web and API security, including OWASP Top 10, OWASP API Security Top 10, authentication, authorization, access control, and business logic vulnerabilities.
• Ability to perform meaningful manual testing rather than relying primarily on automated tools.
• Strong investigative mindset, attention to detail, and ability to identify non-obvious attack paths.
• Understanding of the complete penetration testing process, including methodology, evidence collection, validation, reporting, and retesting.
• Ability to work independently with little day-to-day handholding.
• Experience producing professional penetration testing reports with clear reproduction steps, impact, evidence, and remediation guidance.
• Very good to excellent written and spoken English, including customer-facing technical communication.
• Good understanding of HTTP, APIs, modern web architectures, networking, operating systems, authentication, and access control.

Advantageous Experience & Nice-To-Haves:

• Approximately 2 to 4 years of professional penetration testing, application security, or offensive security experience.
• Experience testing complex APIs, multi-tenant applications, authorization models, and business logic.
• Bug bounty participation or independently discovered vulnerabilities.
• Experience with cloud, mobile, network penetration testing, red team, or AI and LLM application security.
• Familiarity with DAST, SAST, CI/CD security testing, or DevSecOps environments.
• Relevant offensive security certifications.

Personal Attributes:

• Curious and investigative, with a drive to understand how an application works and where its assumptions might fail.
• Creative and persistent when exploring attack paths, including those that automated tools may miss.
• Thorough and attentive to detail, with sound judgment about which findings warrant deeper investigation.
• Self-directed and able to plan, prioritize, and complete assessments with limited oversight.
• Accountable for the accuracy, quality, and completeness of findings and reports.
• Clear and constructive when explaining technical risks and practical fixes to customers and colleagues.
• Collaborative and willing to share techniques, learn from peers, and improve testing methods.
• Ethical and disciplined when testing authorized systems and handling sensitive information.

What We Offer

• A global, remote-first working environment.
• Meaningful ownership over campaigns, marketing operations, and go-to-market initiatives.
• The opportunity to market an innovative cybersecurity product in a rapidly evolving category.
• Direct collaboration with company leadership, Product, Sales, and technical experts.
• A short path between proposing an idea and putting it into action.
• The opportunity to shape Bright’s marketing practices, channels, and positioning as the company grows.
• A diverse and inclusive workplace. Bright Security is an equal-opportunity employer and our team is composed of individuals from many diverse backgrounds, lifestyles, and locations.