[Hiring] Application Penetration Tester @Dunhill Solutions

Role Description

Dunhill Government Solutions is hiring an Application Penetration Tester to safeguard web applications and REST APIs on a federal health program. Guided by the OWASP Top 10 and SANS 25, you will:

• Assess third-party libraries and dependencies
• Run automated and manual code reviews
• Uncover vulnerabilities such as CSRF, XSS, SQL injection, and privilege escalation
• Recommend remediation
• Use BurpSuite as your primary instrument for dynamic and penetration testing
• Write comprehensive findings reports
• Act as a bridge between development teams and stakeholders on security requirements
• Integrate and automate security tools within DevOps CI/CD processes

This is a fully remote (telework) role.

Qualifications

• 3 years of experience in secure code review, specifically with languages such as Scala, Java, JavaScript, and the Spring Framework
• 3 years of practical experience with Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST)
• 3+ years of hands-on manual penetration testing of web applications and REST APIs using BurpSuite Pro and Postman/Bruno
• Deep understanding of secure coding best practices and DevSecOps principles
• Proficiency with OWASP Top 10 and SANS 25 standards and testing guidelines
• Knowledge of Continuous Integration and Continuous Deployment (CI/CD), AWS security principles, Jenkins, and GitHub
• US citizenship

Requirements

• GPEN, GWAPT, OSCP, or CompTIA PenTest+ certification (preferred)

Location

• Remote (telework), United States

Compensation

• $109,600 - $137,000 per year
• US Citizenship and the ability to pass a federal background investigation in order to be granted access to sensitive information