Application Security & Penetration Testing Engineer
Core
Conduct automated and manual security assessments, penetration testing, and vulnerability scanning for web applications and APIs to identify and remediate security flaws.
Role type
Senior IC application security and penetration testing engineer
Builds
Secure web applications and APIs for healthcare and enterprise clients
Domain
Healthcare + Application Security
Required skills
Web application penetration testing, API security testing, vulnerability assessment, secure coding practices, threat modeling, CI/CD integration, risk analysis, remediation guidance, technical documentation
Preferred skills
Healthcare application security, HIPAA/HITECH/HITRUST/SOC 2/NIST frameworks, SAST/SCA/dependency scanning, identity protocol testing (OAuth/OIDC/JWT), secure architecture reviews
Technologies
Burp Suite, OWASP ZAP, Invicti, Azure DevOps, GitHub, SonarQube, REST, JWT, OAuth 2.0, OpenID Connect, .NET, JavaScript
Responsibilities
Conduct automated and manual security assessments of web applications and APIs. Identify and assess vulnerabilities such as broken access control, injection, XSS, and privilege escalation. Validate scan results, eliminate false positives, and assess exploitability. Document findings with technical evidence and remediation recommendations. Work with development teams to review findings and recommend corrective actions. Retest remediated vulnerabilities. Support secure design reviews, threat modeling, and code reviews. Integrate security testing into CI/CD pipelines. Support internal audits and external penetration-testing activities.
Seniority
Senior, hands-on IC
