Sr. Application Security Engineer / Ethical Hacker

As a Senior Application Security Engineer, you will lead manual penetration testing efforts across traditional and AI-enabled applications and drive fixes with development partners.

Responsibilities

• Gather and interpret functional, technical, and architectural requirements to plan application security assessments
• Create testing strategies and test plans based on application functionality, architecture, data flows, and identified risks
• Apply and maintain advanced knowledge of application security testing methodologies, tools, and emerging attack techniques
• Research risks and testing approaches for both traditional applications and AI-enabled applications
• Find opportunities to strengthen penetration testing methodologies, testing effectiveness, and offensive security capabilities
• Evaluate, configure, and use offensive security tools to support application penetration testing
• Develop and maintain scripts, automation, and custom tools to improve testing efficiency and effectiveness
• Set up and maintain testing environments, payloads, and supporting technical resources
• Evaluate new application security and AI security testing tools and techniques
• Support repeatable testing procedures, methodologies, and technical standards
• Plan and execute end-to-end penetration tests for traditional and AI-enabled applications
• Identify, exploit, validate, and document application security vulnerabilities
• Assess attack paths and application-specific risks that may not be found via automated testing
• Share technical findings, risk information, and remediation recommendations with stakeholders
• Retest applications to validate remediation of application security findings
• Review assessment results and provide technical guidance to members of the Application Security team
• Track and report metrics on assessment status, testing coverage, findings, and remediation progress
• Create and maintain penetration testing documentation, methodologies, runbooks, and standard operating procedures
• Mentor and provide technical guidance to less-experienced Application Security team members
• Participate in team planning, retrospectives, and knowledge-sharing activities
• Support Security Champions in reinforcing secure development and AI security practices
• Assist in evaluating security tools, technologies, and service providers
• Perform project and task tracking and reporting as needed

Requirements

• Bachelor’s Degree (or foreign equivalent); or in lieu of a degree, at least 12 years of experience in the field of Information Technology or Business (work experience or a combination of education and work experience in the field of Information Technology or Business)
• 5+ years IT and/or cybersecurity
• 5+ years of application security experience, including hands-on work performing application penetration testing or offensive security assessments
• Advanced knowledge of Web applications, APIs, and common application security vulnerabilities
• Advanced knowledge of manual application penetration testing methodologies and techniques
• Advanced knowledge of authentication, authorization, session management, and application business logic
• Advanced knowledge of Software Development Lifecycle (SDLC) and secure development practices
• Advanced knowledge of AI Architecture and model training processes
• Experience planning and conducting application penetration tests end-to-end, including assessments of cloud-native applications and other modern application architectures
• Experience identifying, exploiting, validating, and documenting application security vulnerabilities
• Experience developing scripts, automation, or custom tools using one or more languages
• Experience using application security and offensive security testing tools
• Experience communicating technical findings, risk, and remediation recommendations to technical and non-technical stakeholders
• Ability to work independently and collaboratively with development teams, security teams, and other stakeholders
• Experience mentoring and providing technical guidance to less-experienced professionals
• Experience conducting threat modeling and evaluating complex application attack paths
• Must be legally authorized to work in the United States without company sponsorship
• Must be at least eighteen (18) years of age

Preferred Experience

• Offensive Security Certified Professional (OSCP) certification (strongly preferred)
• Experience performing security testing of AI-enabled applications, LLMa, or related technologies
• Experience testing mobile applications and legacy industrial systems
• Experience reviewing source code to identify security vulnerabilities
• Experience developing proof-of-concept exploits or modifying security testing tools
• Additional offensive security or application security certifications

Location: Cleveland, OH (remote)

Salary: USD 98,935 - 126,963 per yearly

Minimum Experience: 12 years

Education: Bachelor’s Degree (or foreign equivalent)