Remote Penetration Tester – Web & API Security

Bright Security Inc.; United States; Remote; USD 110,000 - 170,000; Full time

Benefits offered by this job

Remote-first work environment

Ownership over campaigns and go-to-MGT

Opportunity to shape Bright’s security

Direct collaboration with leadership &

Diverse, inclusive workplace

Job summary

Bright Security Inc. is seeking a curious, hands-on Penetration Tester for a full-time, remote role. You will identify and validate vulnerabilities in web apps, APIs, and business logic, using manual and automated techniques.

You will own assessments from scoping to reporting, providing remediation guidance and retesting. You will contribute to testing methodologies, tooling, and knowledge sharing, and may expand into cloud, mobile, red team, or AI security areas based on experience.

Qualifications

• Hands-on penetration testing experience in security assessments or bug hunting.
• Strong knowledge of web/API security and OWASP Top 10/ API Top 10.
• Ability to perform meaningful manual testing beyond automated tools.
• Independent worker with meticulous attention to detail and reporting skills.
• Excellent written and spoken English for customer-facing communication.

Responsibilities

• Perform thorough manual and automated penetration testing of web apps and APIs.
• Plan and execute assessments with minimal supervision.
• Test authentication, authorization, session management, and access control.
• Identify vulnerabilities through investigative testing beyond scanners.
• Develop and validate practical exploit proof-of-concept when appropriate.
• Produce clear, customer-ready findings and remediation guidance.
• Validate fixes through retesting and provide final reports.
• Contribute to testing methodologies, tooling, and knowledge sharing.
• Support testing in cloud, mobile, red team, and AI/LLM security as experienced.

Skills

Penetration testing

Vulnerability research

Bug hunting

Bug bounty work

Offensive security

Web security

API security

OWASP Top 10

OWASP API Security Top 10

Authentication

Authorization

Access control

Business logic vulnerabilities

Manual testing

Investigation & analysis

Documentation & reporting

Customer-facing communication

English writing & speaking

HTTP & APIs knowledge

Modern web architectures

Tools

None

Job description

Bright Security Inc. is seeking a curious, hands-on Penetration Tester for a full-time, remote role. You will identify and validate vulnerabilities in web apps, APIs, and business logic, using manual and automated techniques.

You will own assessments from scoping to reporting, providing remediation guidance and retesting. You will contribute to testing methodologies, tooling, and knowledge sharing, and may expand into cloud, mobile, red team, or AI security areas based on experience.