Penetration Tester - Web & API Security Expert

Bright Security; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Bright Security delivers a developer-centric DAST platform in the United States, helping organizations identify and remediate vulnerabilities across the SDLC. The role focuses on hands-on testing of web apps and APIs, planning assessments from scoping to reporting, and validating exploitation where appropriate.

Ideal candidates combine practical manual testing skills with knowledge of OWASP Top 10/OWASP API Security Top 10, strong reporting capabilities, and proficiency with Burp Suite, Nmap,

Qualifications

• Hands-on penetration testing or offensive security experience.
• Strong knowledge of OWASP Top 10 and OWASP API Security Top 10.
• Meaningful manual testing skills beyond automated scanners.
• Experience writing professional penetration testing reports.
• Familiarity with Burp Suite, Nmap, Postman and command-line tooling.
• Scripting ability in Python, JavaScript or Bash.
• Very good to excellent written and spoken English.

Responsibilities

• Perform manual and automated penetration testing of web applications and APIs.
• Plan and execute assessments independently, from scoping through reporting.
• Test authentication, authorization, session management, access control and business logic.
• Develop and validate proof-of-concept exploitation where appropriate.
• Produce clear, customer-ready findings and reports with remediation guidance.
• Retest fixes and contribute to methodologies and tooling.

Skills

Penetration testing

Scripting (Python/JS/Bash)

Technical reporting

English communication

Tools

Burp Suite

Nmap

Postman

CLI tooling

Job description

Bright Security delivers a developer-centric DAST platform in the United States, helping organizations identify and remediate vulnerabilities across the SDLC. The role focuses on hands-on testing of web apps and APIs, planning assessments from scoping to reporting, and validating exploitation where appropriate.

Ideal candidates combine practical manual testing skills with knowledge of OWASP Top 10/OWASP API Security Top 10, strong reporting capabilities, and proficiency with Burp Suite, Nmap,