Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 17 hours ago

Application Penetration Tester

ASM Research223 open roles

Where
Remote, USA
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowApplication Penetration TesterASM Research · Remote, USA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on ASM Research's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. ASM Research postings stay open a median of 5 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.7%14 days
  5. 35.6%30 days
  6. 58.0%60 days
This job: posted 17 hours ago

ASM Research median: 5 days open

The posting

As an Application Security Penetration Tester, you will be entrusted with the critical responsibility of safeguarding web applications and REST APIs from potential threats. Your role will require a deep understanding of the OWASP Top 10 and SANS 25, as these frameworks will guide your efforts in identifying and mitigating security vulnerabilities.

Your daily tasks will involve performing thorough security assessments of third-party libraries, analyzing dependencies, and conducting both automated and manual code reviews. You will be adept at uncovering a range of security issues, including Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL Injection, and Privilege Escalation, and you will not only identify these vulnerabilities but also provide actionable recommendations for remediation. Mastery of tools like BurpSuite is essential, as it will be your primary instrument in executing dynamic and penetration security testing. Furthermore, you will be expected to write comprehensive reports that detail your findings and suggest enhancements to bolster system security.

In this role, you will also serve as a pivotal bridge between development teams and stakeholders, ensuring that security requirements are clearly communicated and understood. Your ability to define, maintain, and enforce application security best practices will be crucial in maintaining the integrity of the software development lifecycle. You will be involved in software security architecture and design reviews, ensuring that security is integrated from the ground up. Familiarity with Continuous Integration and Continuous Deployment (CI/CD) is necessary, as you will be responsible for integrating and automating security tools within DevOps processes.

Required Skills:

  • Serve as a liaison between development teams and stakeholders to understand and formulate security requirements.
  • Define, maintain, and enforce application security best practices.
  • Deep understanding of OWASP Top 10, SANS 25
  • Perform third-party libraries security assessment and dependency analysis.
  • Conduct vulnerability assessment and manual/automated code review of Java and Scala applications to find security vulnerabilities (CSRF, XSS, SQL Injection, Privilege Escalation, etc.) and recommend remediation.
  • Analyze scan reports from varied tools (SAST, DAST and SCA) to identify the issues, interpretate, and provide recommendation to remediate the vulnerabilities across a variety of applications, programming languages, and platforms
  • Conduct static, dynamic and penetration security testing of Web Applications and REST APIs.
  • Performs software security architecture and design reviews.
  • Write comprehensive reports including assessment-based findings, outcomes, and propositions for further system security enhancement.
  • Identify and demonstrate vulnerabilities to application owners and recommend remediation for security vulnerabilities.
  • Knowledge of scripting language to integrate and automate security tools within DevOps CI/CD processes.

Required Experience:

  • 3 years of experience in Secure Code Review, specifically with languages such as Scala, Java, JavaScript and Spring Framework
  • 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST),
  • 3+ years of hands-on experience with manual penetration testing of Web Applications and REST APIs using BurpSuite Pro and Postman/Bruno
  • Deep understanding of Secure Coding best practices and DevSecOps principles
  • Proficiency of OWASP Top 10 and SANS 25 standards and testing guidelines
  • Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS Security principles, Jenkins and GitHub

Desired Certification: GPEN, GWAPT, OSCP, or CompTIA PenTest+

Compensation Ranges

Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.

EEO Requirements

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

Disclaimer

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against ASM Research's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on ASM Research's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    ASM Research's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.