Penetration Tester - Web Application Security Assessments

The Elite Job; Cranberry Township (Butler County); Hybrid; USD 110,000 - 160,000; Full time

Benefits offered by this job

Competitive pay

Remote or hybrid work options

Professional development opportunities

Certification support

Job summary

The Elite Job is seeking a skilled Penetration Tester – Web Application Security Assessments to join our cybersecurity team. You will identify vulnerabilities, test web apps, APIs, and supporting infra, and provide actionable remediation strategies to strengthen application security.

Collaborate with developers and IT teams, apply industry best practices, and advance modern penetration testing techniques while maintaining high ethical standards.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or related field preferred.
• Equivalent practical experience or training may be considered.
• Strong foundation in networking, OS, web tech, and information security is essential.

Responsibilities

• Conduct authorized penetration tests on web applications, web portals, customer-facing platforms, and internal business apps.
• Identify and validate security vulnerabilities involving authentication, authorization, session management, input validation, and application logic.
• Assess applications against OWASP Top 10 and other recognized testing frameworks.
• Evaluate REST and GraphQL APIs and other web services.
• Test for XSS, SQLi, SSRF, CSRF, and misconfigurations.
• Examine access controls, password policies, and MFA implementations.
• Perform manual security testing to complement automated scans.

Skills

HTTP/HTTPS

OWASP Top 10

Burp Suite

OWASP ZAP

Nmap

REST APIs

JavaScript

Python

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Burp Suite

OWASP ZAP

Nmap

Job description

1. Job Summary

The Elite Job is seeking a skilled and detail-oriented Penetration Tester – Web Application Security Assessments to join our cybersecurity team. The successful candidate will be responsible for identifying security vulnerabilities, evaluating web application defenses, conducting authorized penetration tests, and recommending effective remediation strategies to strengthen application security.

In this role, you will simulate realistic cyberattacks against authorized web applications, APIs, and supporting infrastructure to uncover weaknesses before malicious actors can exploit them. You will collaborate with software developers, security engineers, IT administrators, and other stakeholders to assess security risks, validate fixes, and promote secure software development practices.

The ideal candidate will have a strong understanding of web technologies, common application vulnerabilities, penetration testing methodologies, and security assessment tools. You should be analytical, curious, ethical, and committed to responsible vulnerability disclosure.

At The Elite Job, we value professionals who combine technical expertise with clear communication, sound judgment, and a proactive approach to protecting digital assets. This position offers an opportunity to contribute to meaningful security initiatives while developing expertise in application security and modern penetration testing techniques.

2. Key Responsibilities

Web Application Penetration Testing

• Conduct authorized penetration tests on web applications, web portals, customer-facing platforms, and internal business applications.
• Identify and validate security vulnerabilities involving authentication, authorization, session management, input validation, and application logic.
• Assess applications against the OWASP Top 10 and other recognized application security testing frameworks.
• Evaluate the security of REST APIs, GraphQL APIs, and other web service interfaces.
• Test for common vulnerabilities such as cross-site scripting (XSS), SQL injection, server-side request forgery (SSRF), cross-site request forgery (CSRF), insecure direct object references, and security misconfigurations.
• Examine access controls, privilege boundaries, password policies, and multi-factor authentication implementations.
• Perform manual security testing to complement automated vulnerability scanning and identify complex weaknesses.

Security Assessment and Analysis

• Review application architecture, data flows, technology stacks, and trust boundaries to identify potential attack surfaces.
• Use threat modeling and risk-based testing to prioritize critical areas of concern.
• Analyze application responses, error messages, logs, and system behavior to determine the root causes of vulnerabilities.
• Assess security controls in cloud-hosted web applications and environments where authorized testing is permitted.
• Evaluate the potential business impact of discovered vulnerabilities, including risks to confidentiality, integrity, and availability.
• Distinguish exploitable security weaknesses from false positives and document supporting evidence.

Vulnerability Reporting and Remediation

• Prepare clear, structured penetration testing reports containing findings, severity ratings, evidence, risk explanations, and remediation recommendations.
• Classify vulnerabilities using recognized approaches, including the Common Vulnerability Scoring System (CVSS), where appropriate.
• Provide developers and technical teams with practical guidance for correcting identified security issues.
• Conduct retesting to verify that vulnerabilities have been successfully resolved.
• Maintain accurate records of findings, testing activities, remediation status, and residual risks.
• Escalate critical vulnerabilities through established security incident and risk-management procedures.

Collaboration and Security Improvement

• Work closely with developers, DevOps engineers, security architects, and product teams to integrate security into the software development lifecycle.
• Support secure code reviews and application security assessments when required.
• Contribute to security testing standards, internal procedures, and reusable assessment methodologies.
• Participate in security design reviews and provide recommendations before applications are deployed.
• Assist with improving security awareness by explaining common application vulnerabilities and prevention techniques.
• Stay informed about emerging attack methods, newly disclosed vulnerabilities, security advisories, and industry best practices.

Ethical and Professional Responsibilities

• Perform all testing within documented authorization, approved scope, and agreed testing windows.
• Protect confidential information, credentials, customer data, and other sensitive materials encountered during assessments.
• Avoid unnecessary disruption to production systems and follow established rules of engagement.
• Handle proof-of-concept exploits and collected evidence securely.
• Follow responsible disclosure practices and applicable legal, contractual, and organizational requirements.

3. Required Skills and Qualifications

Educational Qualifications

A bachelors degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related discipline is preferred.

Equivalent practical experience, demonstrable technical skills, or relevant professional training may be considered.

A strong foundation in networking, operating systems, web technologies, and information security is essential.

Technical Skills

• Good understanding of HTTP and HTTPS, DNS, TCP/IP, cookies, browser security mechanisms, and web application architecture.
• Knowledge of common web vulnerabilities and the principles behind exploiting and preventing them.
• Experience with penetration testing tools such as Burp Suite, OWASP ZAP, Nmap, and relevant browser developer tools.
• Familiarity with web technologies, including HTML, JavaScript, SQL, JSON, and REST APIs.
• Understanding of authentication mechanisms, session handling, role-based access control, and identity management.
• Ability to analyze requests and responses, manipulate parameters, inspect headers, and identify abnormal application behavior.
• Familiarity with Linux and Windows environments.
• Basic scripting or programming skills in Python, JavaScript, Bash, or a similar language.
• Understanding of vulnerability severity assessment, risk analysis, and technical reporting.
• Awareness of secure coding practices, encryption fundamentals, and data protection principles.

Preferred Certifications

Candidates with one or more of the following certifications may receive preference:

• Offensive Security Certified Professional (OSCP).
• Burp Suite Certified Practitioner (BSCP).
• Certified Ethical Hacker (CEH).
• CompTIA PenTest+.
• GIAC Web Application Penetration Tester (GWAPT).
• Other recognized application security or penetration testing certifications.

Certifications are advantageous but are not a substitute for practical skills, ethical conduct, and sound technical judgment.

4. Experience

Entry-Level Candidates: Applicants with foundational cybersecurity knowledge, practical lab experience, personal security projects, or relevant training may be considered for junior opportunities.

Intermediate Candidates: Typically, 2–4 years of experience in web application penetration testing, vulnerability assessment, application security, or a closely related field.

Senior Candidates: Typically, 5 or more years of relevant experience, including complex application assessments, technical leadership, or security consulting.

Experience expectations will depend on the level of the position offered.

Candidates should ideally demonstrate experience in:

• Conducting manual and automated web application security assessments.
• Identifying and validating vulnerabilities in web applications and APIs.
• Using penetration testing tools to investigate and reproduce security weaknesses.
• Writing professional security assessment reports with actionable remediation guidance.
• Working with software development teams to verify vulnerability fixes.
• Applying established security testing methodologies and maintaining accurate evidence.
• Handling sensitive information responsibly during authorized security engagements.
• Practical demonstrations of technical ability, responsible testing practices, and clear communication will be valued alongside formal employment history.

5. Working Hours

Employment Schedule: Full-time, subject to the agreed employment contract.

Typical Working Hours: Approximately 40 hours per week, depending on location and company policy.

Work Arrangement: Remote, hybrid, or on-site, depending on the specific vacancy.

Flexibility: Some flexibility may be available to support collaboration across different time zones.

Assessment Windows: Occasional schedule adjustments may be necessary for approved security tests, particularly when testing must take place outside normal business hours.

Meetings and Reporting: Employees are expected to attend project meetings, security reviews, and assessment briefings as required.

Any overtime, weekend work, or on-call responsibilities will be agreed upon in advance and handled according to applicable employment policies and local laws.

6. Knowledge, Skills, and Abilities

Technical Knowledge

• Strong understanding of web application security principles and common attack vectors.
• Knowledge of the OWASP Web Security Testing Guide and OWASP Top 10.
• Familiarity with API security, access control weaknesses, injection vulnerabilities, and security misconfigurations.
• Understanding of vulnerability management, threat modeling, and risk-based testing.
• Awareness of cloud security concepts, software development workflows, and secure deployment practices.

Analytical and Problem-Solving Abilities

• Ability to think critically and approach applications from an adversarial perspective.
• Skill in identifying unusual application behavior and tracing issues to their underlying causes.
• Ability to assess exploitability and business impact without exaggerating risk.
• Confidence in troubleshooting complex technical issues and developing controlled proof-of-concept demonstrations.
• Willingness to research unfamiliar technologies and continuously expand technical knowledge.

Communication Skills

• Ability to prepare concise, accurate, and technically detailed assessment reports.
• Confidence in explaining complex security findings to both technical and non-technical stakeholders.
• Ability to recommend practical remediation measures that developers can implement.
• Strong written communication and documentation skills.
• Professional communication when discussing vulnerabilities, risks, and remediation priorities.

Personal Attributes

• High ethical standards and respect for confidentiality.
• Strong attention to detail and a methodical approach to testing.
• Self-motivation and the ability to manage competing priorities.
• Commitment to continuous learning and professional development.
• Collaborative working style and openness to constructive feedback.
• Accountability for testing activities, findings, and deliverables.

7. Benefits

The Elite Job aims to provide a supportive working environment that encourages technical excellence, professional growth, and responsible security practices. Depending on employment terms, location, and eligibility, benefits may include:

• Competitive compensation aligned with skills, experience, and role responsibilities.
• Potential remote or hybrid working arrangements.
• Opportunities to work on varied web application security assessments.
• Professional development through technical training, workshops, and industry learning resources.
• Opportunities to pursue relevant cybersecurity certifications, subject to company policy.
• Collaboration with experienced IT, software engineering, and cybersecurity professionals.
• Exposure to modern application architectures, API security, and emerging security technologies.
• A supportive environment that values technical curiosity, ethical conduct, and knowledge sharing.
• Opportunities to contribute to improved security processes and organizational resilience.
• Potential career advancement based on performance, demonstrated expertise, and business needs.

Specific benefits, allowances, certification funding, and leave entitlements will be confirmed during the recruitment process.

8. Why Join The Elite Job?

Joining The Elite Job offers an opportunity to apply your cybersecurity knowledge to the practical challenge of protecting web applications and digital services.

As a Penetration Tester, you will help identify weaknesses before they can be exploited, support engineering teams in building more secure products, and contribute to a stronger security culture.

Make a Meaningful Security Impact: Help organizations understand application risks and take informed action to reduce their exposure to cyber threats.

Develop Your Technical Expertise: Build experience in manual penetration testing, API security, vulnerability analysis, and modern application security practices.

Collaborate Across Teams: Work with professionals who contribute to application development, infrastructure, risk management, and security improvement.

Grow Your Career: Develop a foundation for future opportunities in application security engineering, red teaming, security consulting, vulnerability research, or cybersecurity leadership.

Promote Responsible Security: Apply ethical testing principles, protect sensitive information, and help ensure that security improvements are practical and sustainable.

Bring Your Ideas Forward: Contribute to the refinement of testing methods, reporting standards, and remediation processes.

We welcome candidates who are curious, technically motivated, and committed to using their skills responsibly. If you enjoy solving challenging security problems and helping teams build safer digital products, this role may be a strong fit for you.