Web App & API Security Penetration Tester

ASM Research, An Accenture Federal Services Company; Frankfort (KY); On-site; USD 110,000 - 137,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company, is seeking an Application Security Penetration Tester to safeguard web apps and REST APIs by applying OWASP Top 10 and SANS 25 guidelines. You will perform both automated and manual reviews, assess third-party libraries, and deliver actionable remediation reports.

You will bridge development and stakeholders, enforce security best practices, and integrate security tools into DevOps.

Qualifications

• 3 years of experience in Secure Code Review with languages such as Scala, Java, JavaScript and Spring Framework.
• 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST).
• 3+ years of hands-on experience with manual penetration testing of Web Applications and REST APIs using BurpSuite Pro and Postman/Bruno.
• Deep understanding of Secure Coding best practices and DevSecOps principles.
• Proficiency of OWASP Top 10 and SANS 25 standards and testing guidelines.
• Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS Security principles, Jenkins and GitHub.

Responsibilities

• Bridge between development teams and stakeholders to convey security requirements clearly.
• Define, maintain, and enforce application security best practices.
• Conduct security assessments of third-party libraries and dependencies.
• Perform both automated and manual code reviews to identify vulnerabilities (CSRF, XSS, SQL Injection, Privilege Escalation).
• Analyze scan reports (SAST/DAST/SCA) and provide remediation guidance across multiple languages and platforms.
• Conduct static, dynamic, and interactive security testing of Web Applications and REST APIs.
• Perform software security architecture and design reviews and contribute to secure SDLC.
• Write comprehensive reports detailing findings and remediation recommendations.
• Demonstrate vulnerabilities to owners and advise remediation steps.
• Automate security tooling within DevOps CI/CD processes using scripting.

Skills

OWASP Top 10

SANS 25

Security requirements liaison

DevSecOps

CI/CD security integration

Tools

BurpSuite Pro

Postman

Bruno

Jenkins

GitHub

SAST tools

DAST tools

SCA tools

Job description

ASM Research, An Accenture Federal Services Company, is seeking an Application Security Penetration Tester to safeguard web apps and REST APIs by applying OWASP Top 10 and SANS 25 guidelines. You will perform both automated and manual reviews, assess third-party libraries, and deliver actionable remediation reports.

You will bridge development and stakeholders, enforce security best practices, and integrate security tools into DevOps.