Remote Federal App Penetration Tester

Royper Royco LLC; United States; Remote; USD 110,000 - 165,000; Full time

Job summary

Royper Royco LLC is seeking an Application Penetration Tester for a remote, US-based role focused on federal healthcare initiatives. You will perform SAST/DAST, manual and automated testing of web apps and REST APIs (Burp Suite), and help embed security testing into DevOps pipelines.

Responsibilities include translating findings into remediation guidance, reviewing architectures for weaknesses, and delivering detailed security assessment reports.

Qualifications

• > At least 3 years of practical experience with SAST and DAST.
• > 3+ years of hands-on manual penetration testing of web apps and REST APIs using Burp Suite Professional and Postman/Bruno.
• > Strong secure coding practices, DevSecOps, and application security principles.
• > Knowledge of OWASP Top 10 and SANS Top 25.
• > Familiarity with CI/CD, AWS security, Jenkins, and GitHub.
• > Ability to communicate risks clearly and provide remediation guidance.
• > US citizenship and ability to pass a federal background check.
• > Preferred GPEN, GWAPT, OSCP, or PenTest+.

Responsibilities

• Collaborate with developers to translate security requirements into practical measures.
• Promote application security best practices aligned with industry standards.
• Assess third‑party libraries and dependencies for risks.
• Conduct secure code reviews of Java/Scala apps for CSRF, XSS, SQLi, and privilege escalation.
• Analyze SAST/DAST/SCA results and provide actionable remediation recommendations.
• Perform static, dynamic, and manual pen testing of web apps and REST APIs (Burp Suite focus).
• Review security architecture and designs to identify weaknesses and improvements.
• Prepare comprehensive assessment reports with findings, risk levels, and remediation steps.
• Demonstrate vulnerabilities to owners and guide remediations.
• Develop scripts and integrate security testing into DevOps/CI‑CD pipelines.

Skills

Application security

Penetration testing

SAST/DAST

Burp Suite

CI/CD

Tools

Burp Suite Professional

Postman

Bruno

Jenkins

GitHub

AWS security

Job description

Royper Royco LLC is seeking an Application Penetration Tester for a remote, US-based role focused on federal healthcare initiatives. You will perform SAST/DAST, manual and automated testing of web apps and REST APIs (Burp Suite), and help embed security testing into DevOps pipelines.

Responsibilities include translating findings into remediation guidance, reviewing architectures for weaknesses, and delivering detailed security assessment reports.