Web & API Security Penetration Tester

ASM Research, An Accenture Federal Services Company; Boise (ID); On-site; USD 110,000 - 137,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company seeks an Application Security Penetration Tester to safeguard web applications and REST APIs. You will conduct automated and manual testing, focusing on OWASP Top 10 and SANS 25, and provide actionable remediation recommendations.

You will bridge security with development teams, enforce best practices, and help integrate security into CI/CD workflows. Experience with BurpSuite Pro and secure coding is essential.

Qualifications

• Knowledge of OWASP Top 10 and SANS 25 standards and testing guidelines.
• Experience performing secure code review and vulnerability assessment.
• Ability to integrate security into DevOps and CI/CD processes.

Responsibilities

• Perform security assessments of web applications and REST APIs.
• Conduct both automated and manual reviews for vulnerabilities (CSRF, XSS, SQLi, Privilege Escalation).
• Analyze SAST/DAST/ SCA reports and provide remediation guidance.
• Define and enforce application security best practices across SDLC.
• Write comprehensive findings reports and present to stakeholders.
• Collaborate with development teams to implement security controls.

Skills

OWASP Top 10

SANS 25

Vulnerability assessment

Code review

Security requirements

CI/CD security integration

DevSecOps

Security architecture

Communication with stakeholders

Remediation recommendations

Tools

BurpSuite Pro

Jenkins

GitHub

Postman

Job description

ASM Research, An Accenture Federal Services Company seeks an Application Security Penetration Tester to safeguard web applications and REST APIs. You will conduct automated and manual testing, focusing on OWASP Top 10 and SANS 25, and provide actionable remediation recommendations.

You will bridge security with development teams, enforce best practices, and help integrate security into CI/CD workflows. Experience with BurpSuite Pro and secure coding is essential.