Penetration Tester - Web/API & Network Security (Remote)

A-LIGN; Tampa (FL); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) Plan with Employer Matching

Generous Paid Time Off

Certification Reimbursement

Job summary

Pathfynder by A-LIGN is seeking an experienced Penetration Tester to lead offensive security engagements including external network, web applications, and API testing. You will identify real-world risks, manually exploit vulnerabilities, document findings, and provide actionable remediation guidance to clients.

Reporting to the Director of Web Application & External Offensive Operations, this full-time role emphasizes client-facing delivery, collaboration with security teams, and mentoring

Qualifications

• 5+ years of hands-on offensive security experience.
• 3+ years focused on external network, web app, or API testing.
• Experience with black-box, grey-box, and white-box testing approaches.
• Experience testing APIs: REST, GraphQL, SOAP, or gRPC.
• Familiar with OWASP WSTG, ASVS, API Security Top 10; PTES.

Responsibilities

• Execute external network, web application, and API penetration testing engagements.
• Identify, validate, and exploit vulnerabilities using public exploits or custom tooling.
• Deliver client-ready reports with risk ratings, evidence, and remediation guidance.
• Collaborate with the offensive security team to improve delivery methods and mentor juniors.

Skills

Manual testing

Web exploitation

APIs testing

Python scripting

OWASP knowledge

Communication

Independent work

AI/LLM security

Cloud security

Education

Degree in cybersecurity or related field

Tools

Burp Suite

Caido

Nmap

Nuclei

SQLmap

ffuf

Postman

Nessus

Job description

Pathfynder by A-LIGN is seeking an experienced Penetration Tester to lead offensive security engagements including external network, web applications, and API testing. You will identify real-world risks, manually exploit vulnerabilities, document findings, and provide actionable remediation guidance to clients.

Reporting to the Director of Web Application & External Offensive Operations, this full-time role emphasizes client-facing delivery, collaboration with security teams, and mentoring