Senior Manual Ethical Hacker – App Security Expert

Bank of America; Washington (District of Columbia); On-site; USD 117,000 - 148,000; Full time

Job summary

Bank of America is seeking an experienced Manual Ethical Hacker to join the Cyber Security Assurance Offensive Security team. The role focuses on security assessments of bank applications, adapting methods to evolving threats, and reporting risk across multiple lines of business.

You will conduct threat-based analyses, perform manual testing without over-reliance on tools, and collaborate with security partners and CIO clients to drive risk-informed decisions.

Qualifications

• Minimum of 4 years of professional pentesting, application security or ethical hacking experience.
• Detailed technical knowledge in multiple areas including security engineering, auth, and cryptography.
• SQL injection/XSS testing without tools and manual code review experience.
• Experience with SAST tools and remediation discussions.
• Ability to develop PoCs, script, code, and use pentesting tools effectively.
• Experience simulating web app assessments and understanding network/web protocols.

Responsibilities

• Perform analysis of internal and external threats on information systems.
• Incorporate threat actor tactics into offensive security testing.
• Assess security, effectiveness, and practicality of technology systems.
• Leverage innovative thinking to improve processes or products.
• Prepare and present detailed technical information for reports and notifications.
• Provide clear, practical advice on managed risk.
• Mentor junior assessors and develop technical tradecraft.

Skills

Pentesting

Application security

Threat modeling

PoCs

Scripting

Tools

IBM AppScan

Burp Suite

SQLMap

Job description

Bank of America is seeking an experienced Manual Ethical Hacker to join the Cyber Security Assurance Offensive Security team. The role focuses on security assessments of bank applications, adapting methods to evolving threats, and reporting risk across multiple lines of business.

You will conduct threat-based analyses, perform manual testing without over-reliance on tools, and collaborate with security partners and CIO clients to drive risk-informed decisions.