Web Application Penetration Testing

Web Application Penetration Testing Engineer Jobs

2 jobs found

Today

Application Security Penetration Engineer

Citi Irving, TX

Irving, TX

Today

$96k - $145k/yr Full time Ai Enabled Security Ai Security Api Penetration Testing

Apply Now

Job Description

Citi is seeking an Application Security Penetration Engineer to join its Offensive Security team. The role focuses on conducting deep-dive assessments and penetration testing across a range of technologies, with an emphasis on translating findings into clear risk guidance and remediation recommendations.

Role Responsibilities

Perform manual vulnerability assessments and penetration testing across applications and/or infrastructure.
Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
Develop functional proof-of-concept code and exploit scenarios to demonstrate exploitability and tangible impact of security weaknesses.
Research and use LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities.
Find multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths that can bypass manual and traditional automated testing.
Document vulnerabilities with reproduction steps, attack chains, and risk ratings in standardized assessment reports.
Communicate assessment results to both technical and non-technical audiences.
Explain vulnerabilities to application developers, system architects, and ML engineers, including root causes and business impact.
Support remediation by outlining a defense-in-depth approach for business stakeholders.
Recommend actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers to close security gaps.
Stay current with emerging offensive security techniques and participate in threat modeling and adversarial testing across traditional and AI-driven technology stacks.
Support pentesting engagements for the firm’s critical, top-tier applications.
Research ways to automate pentest activities, including the use of AI and LLM tooling, to improve vulnerability discovery.

Required Qualifications

Minimum 1 to 3 years of hands-on experience in penetration testing, application security assessment, or software development, ideally in an enterprise environment.
Hands-on experience with dynamic, proxy, and network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk.
Exposure to AI security and adversarial testing tools including Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous.
Strong foundation in enterprise programming and scripting languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
Familiarity with common web and application framework stacks such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries.
Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads.
Deep knowledge of industry security standards, including OWASP Top 10 and CWE/SANS Top 25.
Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.

Skills and Technologies

Penetration testing and vulnerability assessment: Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, OWASP ZAP
Static analysis and software composition: Checkmarx, BlackDuck, SonarQube, Snyk
AI security and adversarial testing: Garak, PyRIT, Counterfit, Adversarial Robustness Toolbox (ART)
Programming and scripting: Python, Java, .NET/C#, C/C++, Ruby, NodeJS
Frameworks and ecosystems: Spring, AngularJS, React, Struts, ASP.NET Core
Security and standards: OWASP Top 10, CWE/SANS Top 25, OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF
Cloud platforms: GCP, AWS, Azure

Education and Certifications

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline. Equivalent professional or hands-on experience may be considered in lieu of a degree.
Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.

Benefits

Medical, dental & vision coverage
401(k)
Life, accident, and disability insurance
Wellness programs
Paid time off packages including planned time off (vacation), unplanned time off (sick leave), and paid holidays

Position Details

Location: Irving, TX (onsite)
Salary: USD 96,400 to 144,600 per year
Time Type: Full time
Job Family Group: Technology
Job Family: Information Security
Primary Location: Irving Texas, United States
Anticipated posting close date: Oct 20, 2026

View full job page →

7d ago

Application Security and Penetration Testing Engineer

Agadia Systems Inc Parsippany, NJ

Parsippany, NJ

7d ago

$110k - $125k/yr Full time Api Security Application Security Cybersecurity Tools

Apply Now

Job Description

Agadia Systems Inc is looking for an Application Security and Penetration Testing Engineer to help strengthen the security of enterprise web applications, APIs, and supporting services. In this onsite role in Parsippany-Troy Hills, NJ, you will use both automated and manual methods to assess risk, validate vulnerabilities, and partner with development to remediate issues.

You will be responsible for driving hands-on application and API security testing, with a focus on environments that may involve healthcare data and application architecture requirements.

Key Responsibilities

Conduct security assessments of web applications, APIs, and related services using automated vulnerability scanning and DAST tools.
Perform manual penetration testing to uncover vulnerabilities that automated tools may miss.
Test authentication, authorization, session management, access controls, input validation, file handling, APIs, and application business logic.
Identify and investigate issues such as broken access control, injection vulnerabilities, cross-site scripting, insecure configurations, information exposure, and privilege escalation.
Validate scan results by removing false positives and determining exploitability and business impact for confirmed findings.
Document findings with technical evidence, reproduction steps, severity, risk, business impact, and remediation recommendations.
Collaborate with development and architecture teams to review findings and recommend practical corrective actions.
Retest remediated vulnerabilities and formally confirm closure.
Support secure design reviews, threat modeling, code reviews, and release-readiness assessments.
Help incorporate application security testing into the software development lifecycle and CI/CD pipelines.
Maintain vulnerability status, remediation timelines, risk exceptions, and security assessment reporting.
Support internal audits, customer security reviews, and external penetration-testing activities.
Provide application security guidance and knowledge-sharing sessions for development and QA teams.
Stay current with emerging vulnerabilities, attack techniques, security tools, and application security best practices.

Required Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline, or equivalent professional experience.
Five or more years of information security experience, including at least three years of hands-on web application and API penetration testing.
Strong knowledge of OWASP Top 10, OWASP API Security Top 10, CWE, CVSS, and common application attack techniques.
Hands-on experience with tools such as Burp Suite Professional, OWASP ZAP, Invicti, or comparable DAST and penetration-testing platforms.
Experience manually testing authentication, authorization, session management, role-based access, APIs, and business-logic controls.
Ability to validate findings independently and distinguish exploitable vulnerabilities from false positives.
Understanding of HTTP/HTTPS, REST APIs, cookies, tokens, browser security controls, and web application architecture.
Familiarity with secure coding practices and application security considerations for .NET and JavaScript-based applications.
Ability to communicate technical vulnerabilities, business impact, and remediation guidance to both technical and leadership audiences.
Strong analytical, documentation, collaboration, and problem-solving skills.

Technologies and Tools

Burp Suite Professional, OWASP ZAP, Invicti, DAST
OWASP Top 10, OWASP API Security Top 10, CWE, CVSS
HTTP/HTTPS, REST APIs, .NET, JavaScript
Azure DevOps, GitHub, SAST
Software composition analysis, dependency scanning, secrets scanning, SonarQube
Threat modeling
OAuth 2.0, OpenID Connect, JWT

Preferred Qualifications

Experience securing healthcare applications or other systems that handle sensitive or regulated information.
Knowledge of HIPAA, HITECH, HITRUST, SOC 2, NIST, and related security frameworks.
Experience with SAST, software composition analysis, dependency scanning, secrets scanning, and SonarQube.
Experience integrating security testing into Azure DevOps, GitHub, or similar CI/CD platforms.
Familiarity with threat modeling, secure architecture reviews, and source-code security reviews.
Experience testing single sign-on, OAuth 2.0, OpenID Connect, JWT, and other identity protocols.
Relevant certifications such as OSCP, OSWE, GWAPT, GPEN, CEH, or CISSP.

Benefits

Medical, Dental, Vision
Life Insurance
401(k)
PTO

Success Measures

Earlier identification of application and API security risks.
Accurate findings with minimal false positives.
Clear, actionable remediation guidance for development teams.
Timely validation and closure of identified vulnerabilities.
Improved application security coverage throughout the development lifecycle.
Reduced dependence on periodic external penetration testing.

Key Competencies

Communicates effectively, including strong oral and written communication.
Manages ambiguity with flexibility in changing conditions.
Manages complexity with organization, attention to detail, and ability to handle multiple tasks.
Ensures accountability by following through on commitments and working independently as part of a small team.

Compensation: USD 110,000 - 125,000 per year. Location: Parsippany-Troy Hills, NJ (onsite).

View full job page →

Web Application Penetration Testing Engineer Jobs

Application Security Penetration Engineer

Application Security and Penetration Testing Engineer

Get Web Application Penetration Testing Engineer Jobs alerts