Penetration Tester

Strategic Staffing Solutions; United States; Hybrid; USD 90.000 - 92.000; Teilzeit

Zusammenfassung

Strategic Staffing Solutions seeks a Senior Information Security Analyst – Penetration Tester to support bug bounty operations with hands-on testing and automation.

You will perform web app and infrastructure pentests, validate findings, triage submissions, and help implement scalable, AI-assisted workflows to speed remediation while reducing false positives. Remote-ready for exceptional candidates, with on-site options in Texas.

Qualifikationen

• Experience in web application and infrastructure penetration testing.
• Experience validating, reproducing, and triaging vulnerabilities and Bug Bounty submissions.
• Familiarity with CVSS, DREAD, or similar risk assessment methods.

Aufgaben

• Perform web app and infrastructure pentesting to identify vulnerabilities and attack vectors.
• Review and triage Bug Bounty submissions for legitimacy, severity, and business impact.
• Document vulnerabilities and create/update tickets in vulnerability management systems.
• Collaborate with developers to remediate vulnerabilities and provide secure coding guidance.
• Develop workflows for vulnerability validation, triage, prioritization, and reporting.

Kenntnisse

Penetration testing

Vulnerability assessment

Bug bounty triage

Automation scripting

APIs & AI-assisted tools

Technical communication

Risk analysis

Vulnerability management tools

Python/PowerShell

Tools

ServiceNow

Jira

Azure DevOps

Python

PowerShell

Jobbeschreibung

Senior Information Security Analyst – Penetration Tester

Location: San Antonio, TX or Plano TX- ***REMOTE for exceptional candidates

Position Type: Contract

Rate: $65-$67/Hr. (W2 Only)

Job Summary

We are seeking an experienced Senior Information Security Analyst – Penetration Tester to support the Information Security team in automating and scaling its Bug Bounty program. The ideal candidate will have strong hands-on experience in web application and infrastructure penetration testing, vulnerability assessment, security finding validation, and remediation support.

In this role, the selected candidate will evaluate and validate reported security vulnerabilities, triage and prioritize findings based on risk, and integrate confirmed issues into the enterprise ticketing system. The candidate will also contribute to developing scalable processes that leverage scripting, automation, APIs, and AI-assisted tools to improve vulnerability validation and prioritization.

The successful candidate will work closely with developers and security stakeholders to improve application security, reduce false positives, eliminate duplicate findings, and accelerate vulnerability remediation.

Key Responsibilities

• Perform web application and infrastructure penetration testing to identify security vulnerabilities and potential attack vectors.
• Review, validate, reproduce, and triage Bug Bounty submissions to determine their legitimacy, severity, and potential business impact.
• Identify false positives, duplicate findings, and incomplete or inaccurate vulnerability reports.
• Assess and prioritize security findings using industry-standard risk assessment methodologies, including CVSS, DREAD, or similar frameworks.
• Document confirmed vulnerabilities and create or update tickets in enterprise vulnerability management and ticketing platforms.
• Collaborate with software developers and security teams to support vulnerability remediation and provide secure coding recommendations.
• Develop and improve workflows for vulnerability validation, triage, prioritization, and reporting.
• Leverage scripting, automation, APIs, and AI-assisted tools to improve the efficiency and scalability of security operations.
• Contribute to the development of AI-driven processes for validating and prioritizing security findings.
• Maintain clear technical documentation of findings, risk assessments, remediation recommendations, and testing results.
• Support continuous improvement of the Bug Bounty program and associated vulnerability management processes.

Required Qualifications

• Demonstrated experience in web application and infrastructure penetration testing.
• Hands-on experience validating, reproducing, and triaging security vulnerabilities and Bug Bounty submissions.
• Strong understanding of vulnerability assessment, risk analysis, and severity classification using CVSS, DREAD, or comparable methodologies.
• Experience working with developers to remediate vulnerabilities and provide practical secure coding guidance.
• Familiarity with vulnerability management and enterprise ticketing platforms, such as ServiceNow, Jira, Azure DevOps, or similar tools.
• Experience using scripting languages, automation frameworks, APIs, or AI-assisted workflows to streamline security testing and analysis.
• Strong analytical, troubleshooting, documentation, and communication skills.
• Ability to communicate technical vulnerabilities and risk implications clearly to technical stakeholders.

Preferred Qualifications

• Industry-recognized penetration testing or security certifications, such as:
• Offensive Security Certified Professional (OSCP)
• Other equivalent industry-recognized certifications
• Experience supporting or scaling Bug Bounty programs.
• Familiarity with large-scale vulnerability management processes and automated security finding ingestion.
• Experience with Python, PowerShell, or similar scripting languages.
• Exposure to large language models (LLMs) and AI-assisted security validation, analysis, and prioritization workflows.

Ideal Candidate Profile

The ideal candidate is a hands-on penetration tester who combines technical security expertise with automation and vulnerability management experience. This individual should be comfortable evaluating security findings, distinguishing actionable vulnerabilities from false positives, working collaboratively with developers, and building repeatable processes that improve the effectiveness of an enterprise security program.

Interested candidates should have a strong background in penetration testing, vulnerability triage, remediation collaboration, and security automation.