Senior Penetration Tester — Hybrid (Fri Remote)

CoStar Realty Information, Inc.; Arlington (VA); Hybrid; USD 115,000 - 203,000; Full time

Benefits offered by this job

Healthcare

Life insurance

Mental health support

Commuter benefits

401K with company match

Employee stock purchase plan

Paid time off

Tuition reimbursement

On-site fitness facilities

Employee resource groups

Snacks & beverages

Job summary

CoStar Group in Arlington, VA is seeking a Senior Penetration Tester to lead tests on web applications and infrastructure, develop test plans, and demonstrate exploitability to engineering, security peers, and senior leadership.

You will stay current with attacker tradecraft and mentor engineers on offensive techniques, while collaborating across teams in a hybrid work model (in office Mon–Thu, remote Fri).

Qualifications

• Bachelor's Degree in Computer Science, Cybersecurity, or related field.
• 6+ years in a technical role (security, software development, or systems engineering).
• At least 3 years focused on penetration testing or offensive security.
• Experience with web app and API penetration testing, exploiting attack chains.
• Experience writing vulnerability risk reports for developers and senior leadership.
• Secure code review to identify vulnerabilities.
• Scripting/programming in Python, PowerShell, or similar; reading code in C#/Java/JS/Go.

Responsibilities

• Lead penetration tests on web applications and underlying infrastructure.
• Develop test plans validating vulnerabilities and demonstrate exploitability to teams and leadership.
• Collaborate with detection engineering and incident response on purple team exercises.
• Grow pentesting capabilities in infrastructure and cloud-native domains (CI/CD, AD, AWS, Kubernetes).
• Recommend remediations addressing root causes (code changes, architecture, controls).
• Mentor engineers on offensive techniques and attacker mindset.

Skills

Penetration testing

Web application testing

API testing

Scripting (Python/PowerShell)

Code reading (C#/Java/JS/Go)

Communication skills

Education

Bachelor's degree in Computer Science/Cybersecurity

Tools

Burp Suite

OWASP ZAP

Nmap

BloodHound

Metasploit

Job description

CoStar Group in Arlington, VA is seeking a Senior Penetration Tester to lead tests on web applications and infrastructure, develop test plans, and demonstrate exploitability to engineering, security peers, and senior leadership.

You will stay current with attacker tradecraft and mentor engineers on offensive techniques, while collaborating across teams in a hybrid work model (in office Mon–Thu, remote Fri).