Web Application Pentester

ZeroPath; Amherst (MA); Remote; USD 80,000 - 100,000; Part time

Job summary

A cybersecurity firm is seeking a part-time contractor for penetration testing roles focused on web application security. The ideal candidate will perform dynamic testing and manual code reviews, delivering clear reports for clients. This position offers flexibility in hours, suited for US-based students and recent graduates with work authorization. Knowledge of the OWASP Top 10 and excellent technical writing skills are essential.

Qualifications

• Hands-on experience with web apps and API testing.
• Ability to conduct manual code reviews for vulnerabilities.
• Solid grasp of common vulnerability classes.

Responsibilities

• Conduct dynamic penetration testing and source code reviews.
• Triage findings from SAST scanner.
• Deliver professional penetration test reports.

Skills

Dynamic penetration testing

Manual source code reviews

Technical writing

Knowledge of OWASP Top 10

Job description

Expires on November 26, 2025

ZeroPath is seeking candidates with hands-on experience in web application security to support our penetration testing engagements. This role supports short-term penetration testing engagements by combining automated scanning, manual code review, and dynamic testing. Contractors will validate vulnerabilities, deliver client-ready reports, and assist with re-testing after remediation.

Details

• The position is a part-time, remote and flexible contractor role.
• Hours will vary depending on workload, typically averaging 10–30 hours per week.
• Core work: triage findings from ZeroPath’s in-house SAST scanner, perform dynamic penetration testing, and conduct security focused manual source code reviews.
• Deliverables include clear, professional penetration test reports and re-test confirmations after remediation.

Basic Qualifications

• Hands-on experience performing dynamic pentesting of web apps and APIs, covering authentication, input validation & injection, and access control
• Proven ability to conduct manual source code reviews for security vulnerabilities in web applications.
• Solid grasp of the OWASP Top 10 and practical remediation guidance.
• Familiarity with common vulnerability classes and PoCs (e.g., SQLi, XSS, SSTI, deserialization, IDOR, SSRF)
• Strong technical writing: Vulnerability details, proof of concepts, and actionable remediation guidance for mixed audiences.
• Professionalism with client deliverables, deadlines, and confidentiality
• No specific school year requirement – open to all students and recent graduates

Preferred Qualifications (Nice to have)

• Proven impact in bug bounty programs (e.g., HackerOne, Bugcrowd)
• Public recognition in vendor or industry “Security Hall of Fame” acknowledgments, credits in security advisories, or published CVEs.
• CTF achievements (notable placements/solve experience in Web)
• Certifications: OSWE, OSCP, OSCE3, OSEP, OSED, GWAPT, GPEN
• Open-source/security community engagement: conference talks, blog posts, or contributions to security tooling.

This position is open to US based students and recent graduates with US work authorization