Pentesting Tools

Pentesting Tools Engineer Jobs

2 jobs found

Today

Senior Penetration Tester / Red Team Engineer

Cognizant New York, NY

New York, NY

Today

$134k - $155k/yr Full time Senior Api Penetration Testing Application Security

Apply Now

Job Description

Lead offensive security efforts to uncover exploitable weaknesses and strengthen enterprise cyber resilience through evidence-based penetration testing.

Responsibilities

Conduct comprehensive penetration testing across web applications, APIs, networks, cloud environments, mobile applications, and Windows/Linux systems.
Run vulnerability assessments using automated scanning platforms and manual testing to identify security weaknesses.
Simulate realistic adversary scenarios to evaluate authentication, authorization, access controls, network defenses, and overall security resilience.
Identify and validate vulnerabilities, misconfigurations, exposed credentials, insecure code, and potential attack paths across enterprise environments.
Use offensive security tools including Burp Suite, Metasploit, Nmap, Kali Linux, Pentera, and vulnerability scanning platforms.
Develop Python and Bash scripts, automation utilities, and custom testing approaches to improve testing efficiency and coverage.
Produce documentation covering assessment methodologies, technical evidence, risk impact, and findings, with clear remediation recommendations for stakeholders.
Collaborate with application, infrastructure, cloud, and security teams to remediate findings and validate fixes via retesting.
Research emerging threats, CVEs, OWASP vulnerabilities, exploitation techniques, and evolving offensive security methodologies.
Support security assessments, compliance initiatives, risk reviews, and continuous improvement of enterprise offensive security capabilities.

Requirements

8+ years of hands-on experience in Penetration Testing, Red Teaming, Offensive Security, or Security Engineering.
Expert-level experience delivering penetration tests across web applications, networks, APIs, endpoints, cloud platforms, and enterprise infrastructure.
Strong expertise in vulnerability exploitation, attack-path analysis, credential security, authentication testing, and security control validation.
Advanced hands-on experience with offensive security tools: Burp Suite, Metasploit, Nmap, Kali Linux, Pentera Console/Surface, and vulnerability scanners.
Strong scripting and automation skills using Python, Bash, PowerShell, or similar technologies.
Deep understanding of OWASP, CVE/CVSS, MITRE ATT&CK, network security, application security, and modern attack methodologies.
Experience working with development and infrastructure teams to provide remediation guidance and perform validation/retesting of security fixes.
Strong technical reporting skills, with the ability to communicate vulnerabilities, business impact, and remediation priorities to technical and leadership audiences.
Relevant certifications are preferred: OSCP, OSEP, OSWE, GPEN, GXPN, CRTO, or equivalent offensive security certifications.

Technologies

Burp Suite
Metasploit
Nmap
Kali Linux
Pentera
Pentera Console/Surface
Python
Bash
PowerShell
OWASP
CVE/CVSS
MITRE ATT&CK

Benefits

Medical/Dental/Vision/Life Insurance
Paid holidays plus Paid Time Off
401(k) plan and contributions
Long-term/Short-term Disability
Paid Parental Leave
Employee Stock Purchase Plan

Salary and other compensation

Annual salary: $134,000 - $154,500 per year, depending on experience and other qualifications.
Eligible for Cognizant’s discretionary annual incentive program, subject to plan terms and performance.

View full job page →

7d ago

Application Security and Penetration Testing Engineer

Agadia Systems Inc Parsippany, NJ

Parsippany, NJ

7d ago

$110k - $125k/yr Full time Api Security Application Security Cybersecurity Tools

Apply Now

Job Description

Agadia Systems Inc is looking for an Application Security and Penetration Testing Engineer to help strengthen the security of enterprise web applications, APIs, and supporting services. In this onsite role in Parsippany-Troy Hills, NJ, you will use both automated and manual methods to assess risk, validate vulnerabilities, and partner with development to remediate issues.

You will be responsible for driving hands-on application and API security testing, with a focus on environments that may involve healthcare data and application architecture requirements.

Key Responsibilities

Conduct security assessments of web applications, APIs, and related services using automated vulnerability scanning and DAST tools.
Perform manual penetration testing to uncover vulnerabilities that automated tools may miss.
Test authentication, authorization, session management, access controls, input validation, file handling, APIs, and application business logic.
Identify and investigate issues such as broken access control, injection vulnerabilities, cross-site scripting, insecure configurations, information exposure, and privilege escalation.
Validate scan results by removing false positives and determining exploitability and business impact for confirmed findings.
Document findings with technical evidence, reproduction steps, severity, risk, business impact, and remediation recommendations.
Collaborate with development and architecture teams to review findings and recommend practical corrective actions.
Retest remediated vulnerabilities and formally confirm closure.
Support secure design reviews, threat modeling, code reviews, and release-readiness assessments.
Help incorporate application security testing into the software development lifecycle and CI/CD pipelines.
Maintain vulnerability status, remediation timelines, risk exceptions, and security assessment reporting.
Support internal audits, customer security reviews, and external penetration-testing activities.
Provide application security guidance and knowledge-sharing sessions for development and QA teams.
Stay current with emerging vulnerabilities, attack techniques, security tools, and application security best practices.

Required Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline, or equivalent professional experience.
Five or more years of information security experience, including at least three years of hands-on web application and API penetration testing.
Strong knowledge of OWASP Top 10, OWASP API Security Top 10, CWE, CVSS, and common application attack techniques.
Hands-on experience with tools such as Burp Suite Professional, OWASP ZAP, Invicti, or comparable DAST and penetration-testing platforms.
Experience manually testing authentication, authorization, session management, role-based access, APIs, and business-logic controls.
Ability to validate findings independently and distinguish exploitable vulnerabilities from false positives.
Understanding of HTTP/HTTPS, REST APIs, cookies, tokens, browser security controls, and web application architecture.
Familiarity with secure coding practices and application security considerations for .NET and JavaScript-based applications.
Ability to communicate technical vulnerabilities, business impact, and remediation guidance to both technical and leadership audiences.
Strong analytical, documentation, collaboration, and problem-solving skills.

Technologies and Tools

Burp Suite Professional, OWASP ZAP, Invicti, DAST
OWASP Top 10, OWASP API Security Top 10, CWE, CVSS
HTTP/HTTPS, REST APIs, .NET, JavaScript
Azure DevOps, GitHub, SAST
Software composition analysis, dependency scanning, secrets scanning, SonarQube
Threat modeling
OAuth 2.0, OpenID Connect, JWT

Preferred Qualifications

Experience securing healthcare applications or other systems that handle sensitive or regulated information.
Knowledge of HIPAA, HITECH, HITRUST, SOC 2, NIST, and related security frameworks.
Experience with SAST, software composition analysis, dependency scanning, secrets scanning, and SonarQube.
Experience integrating security testing into Azure DevOps, GitHub, or similar CI/CD platforms.
Familiarity with threat modeling, secure architecture reviews, and source-code security reviews.
Experience testing single sign-on, OAuth 2.0, OpenID Connect, JWT, and other identity protocols.
Relevant certifications such as OSCP, OSWE, GWAPT, GPEN, CEH, or CISSP.

Benefits

Medical, Dental, Vision
Life Insurance
401(k)
PTO

Success Measures

Earlier identification of application and API security risks.
Accurate findings with minimal false positives.
Clear, actionable remediation guidance for development teams.
Timely validation and closure of identified vulnerabilities.
Improved application security coverage throughout the development lifecycle.
Reduced dependence on periodic external penetration testing.

Key Competencies

Communicates effectively, including strong oral and written communication.
Manages ambiguity with flexibility in changing conditions.
Manages complexity with organization, attention to detail, and ability to handle multiple tasks.
Ensures accountability by following through on commitments and working independently as part of a small team.

Compensation: USD 110,000 - 125,000 per year. Location: Parsippany-Troy Hills, NJ (onsite).

View full job page →

Pentesting Tools Engineer Jobs

Senior Penetration Tester / Red Team Engineer

Application Security and Penetration Testing Engineer

Get Pentesting Tools Engineer Jobs alerts