Web & API Security Penetration Tester

ASM Research, An Accenture Federal Services Company; Denver (CO); On-site; USD 110,000 - 137,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company, seeks an Application Security Penetration Tester to protect web apps and REST APIs by applying OWASP Top 10 and SANS 25. You will conduct both automated and manual reviews, assess third‑party libraries, and report findings with remediation guidance.

You will bridge development and stakeholders to ensure security requirements are clear and integrated into the SDLC, with emphasis on CI/CD automation and secure design reviews.

Qualifications

• Serve as a liaison between development teams and stakeholders to understand and formulate security requirements.
• Define, maintain, and enforce application security best practices.
• Deep understanding of OWASP Top 10, SANS 25.
• Perform third-party libraries security assessment and dependency analysis.
• Conduct vulnerability assessment and manual/automated code review of Java and Scala applications to find security vulnerabilities and recommend remediation.
• Analyze scan reports from varied tools (SAST, DAST and SCA) to identify issues and provide remediation recommendations.
• Conduct static, dynamic and penetration security testing of Web Applications and REST APIs.
• Perform software security architecture and design reviews.
• Write comprehensive reports including findings and propositions for security enhancements.
• Identify and demonstrate vulnerabilities to owners and recommend remediation.
• Knowledge of scripting language to integrate security tools within DevOps CI/CD processes.

Responsibilities

• Bridge between development teams and stakeholders to ensure security requirements are understood.
• Define and enforce security best practices across projects.
• Continuously apply OWASP Top 10 and SANS 25 standards in assessments.
• Assess third-party libraries and dependencies for security risks.
• Perform manual and automated reviews of Java/Scala code to uncover vulnerabilities.
• Interpret SAST/DAST/SCA findings and advise remediation.
• Execute static, dynamic, and penetration testing on web apps and APIs.
• Contribute to security architecture and design reviews for new systems.
• Produce detailed reports with actionable security recommendations.
• Demonstrate vulnerabilities to application owners and guide fixes.
• Automate security tooling within CI/CD pipelines.

Skills

Stakeholder liaison

Security best practices

OWASP Top10

SANS 25

Third-party libraries

Dependency analysis

Vulnerability assessment

Code review

Java

Scala

CSRF

XSS

SQL Injection

Privilege escalation

SAST

DAST

SCA

Static testing

Dynamic testing

Penetration testing

Software security architecture

Security reports

Remediation recommendations

CI/CD scripting

DevSecOps

BurpSuite Pro

Postman

Bruno

Tools

BurpSuite Pro

Postman

Bruno

Job description

ASM Research, An Accenture Federal Services Company, seeks an Application Security Penetration Tester to protect web apps and REST APIs by applying OWASP Top 10 and SANS 25. You will conduct both automated and manual reviews, assess third‑party libraries, and report findings with remediation guidance.

You will bridge development and stakeholders to ensure security requirements are clear and integrated into the SDLC, with emphasis on CI/CD automation and secure design reviews.