Remote Application Security Engineer — Penetration Testing

Embedded Shishya; United States; Remote; USD 56,000 - 167,000; Full time

Job summary

Invadel is a New York City penetration testing firm offering fixed-scope, fixed-price engagements with public pricing at invadel.com/pricing. This contract role is remote within the United States, paid per engagement, with a typical four-to-eight day review of defined repositories, followed by a retest of fixes.

The role involves triaging static analysis, reviewing authentication and authorization, tracing data flows, and delivering findings with references and remediation guidance to engineers

Qualifications

• Four or more years split between software engineering and application security, with production code review as a regular part of the work.
• Reading fluency in at least three of JavaScript/TypeScript, Python, Java or Kotlin, C#, Go, PHP, Ruby, Swift.
• Based in the United States with authorization to work here.
• Reports written for engineers and auditors, with a redacted sample report as part of the application.
• Two professional references.

Responsibilities

• Triage static analysis output and remove false positives before a client sees them.
• Manually review authentication, authorization, input handling, cryptography, secrets management and third-party dependencies.
• Trace data flows across services to find flaws that only appear in combination.
• Write findings with file and line references, proof of exploitability where safe, and remediation code where it helps.
• Retest fixes and update the report.

Skills

Software engineering

Application security

Code review

Tools

SAST tooling

Job description

Invadel is a New York City penetration testing firm offering fixed-scope, fixed-price engagements with public pricing at invadel.com/pricing. This contract role is remote within the United States, paid per engagement, with a typical four-to-eight day review of defined repositories, followed by a retest of fixes.

The role involves triaging static analysis, reviewing authentication and authorization, tracing data flows, and delivering findings with references and remediation guidance to engineers