Start searching
Back to Jobs
Technology

Penetration Tester

Hudson Data LLCUnited States🇺🇸United States

Quick overview

SeniorityMid Senior
Work modeHybrid
LocationUnited States
SOAPSQLOWASPBashHIPAAHTTPJavaPenetration TestingPythonREST

Job description

POSITION OVERVIEW
• The Penetration Tester / Ethical Hacker is responsible for identifying, validating, exploiting, and supporting remediation of security vulnerabilities within large-scale Java applications. This is a hands-on technical role focused on application penetration testing and ethical hacking using real-world attack techniques.
• The successful candidate will combine strong Java development/engineering knowledge with practical penetration testing experience and work closely with Development and Testing teams to identify vulnerabilities, validate exploitability, and strengthen application security.
MINIMUM QUALIFICATIONS
• Education: Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field.
• Minimum 6 years of combined Development and/or Security experience.
• Prior software engineering/development experience, including Core Java coding.
• Hands-on Penetration Testing / Ethical Hacking experience focused on Java/J2EE application security.
• Experience supporting a large-scale, public-facing enterprise application.
• Experience working in a DevSec or application security environment.
REQUIRED TECHNICAL / FUNCTIONAL SKILLS
• Core Java programming and strong understanding of Java application architecture and security practices.
• Hands-on web application penetration testing using manual and automated techniques.
• Ability to validate and exploit vulnerabilities and create/modify proof-of-concept exploits.
• Manipulation of URLs, query parameters, HTTP requests, browser data, tokens, sessions, and cache behavior.
• OWASP-related vulnerabilities and exploitation techniques, including SQL injection, XSS, authentication and authorization weaknesses.
• Hands-on use of Burp Suite and familiarity with Metasploit.
• Familiarity with Fortify on Demand SAST/DAST and MITRE ATT&CK.
• Understanding of cryptography and SSL/TLS.
• Scripting experience supporting penetration testing and security analysis.
• Ability to clearly document technical findings, exploitability, risk, evidence, and remediation.
KEY RESPONSIBILITIES
• Conduct hands-on penetration tests and vulnerability assessments of Java applications and supporting infrastructure.
• Identify application security weaknesses using manual and automated techniques.
• Simulate attacker techniques and develop or modify exploits to determine actual exploitability.
• Analyze workflows, authentication, authorization, sessions, tokens, browser data, URLs, query parameters, and other attack surfaces.
• Collaborate with Development teams to understand architecture, identify weaknesses, and provide remediation/secure coding guidance.
• Collaborate with Testing teams to integrate security considerations into manual and automated testing.
• Document findings, technical evidence, risk, business impact, and recommended corrective actions.
• Validate remediation through follow-up testing and retesting.
• Monitor relevant Java threats, vulnerabilities, and published NIST CVEs.
• Support secure SDLC improvement and application security standards/practices.
PREFERRED QUALIFICATIONS
• OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or comparable certification.
• Python, Bash, or other penetration-testing scripting experience.
• Secure Java code review experience.
• API penetration testing experience, including REST and/or SOAP.
• Cloud security testing and/or mobile application penetration testing.
• HIPAA or comparable regulated-environment knowledge.
• SCA/SBOM experience identifying vulnerable third-party components.
• AI-assisted security tools used to identify vulnerabilities or attack paths, with manual validation of exploitability.
CANDIDATE PROFILE
• Candidate should clearly explain a current/recent Java application they personally penetration tested, including application purpose and architecture.
• Candidate should distinguish their individual role and the penetration testing activities they personally performed.
• Candidate should provide specific examples of vulnerabilities personally identified, exploited, validated, documented, and retested.
• Candidate should explain hands-on Burp Suite use rather than relying solely on automated scanning.
• Candidate should demonstrate how Java development knowledge contributes to vulnerability identification and collaboration with Development.
• Candidate should distinguish Hands-on Experience, Working Knowledge, and Exposure.

Similar jobs

Apply