| POSITION OVERVIEW |
| • The Penetration Tester / Ethical Hacker is responsible for identifying, validating, exploiting, and supporting remediation of security vulnerabilities within large-scale Java applications. This is a hands-on technical role focused on application penetration testing and ethical hacking using real-world attack techniques. |
| • The successful candidate will combine strong Java development/engineering knowledge with practical penetration testing experience and work closely with Development and Testing teams to identify vulnerabilities, validate exploitability, and strengthen application security. |
| | | | |
| MINIMUM QUALIFICATIONS |
| • Education: Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field. |
| • Minimum 6 years of combined Development and/or Security experience. |
| • Prior software engineering/development experience, including Core Java coding. |
| • Hands-on Penetration Testing / Ethical Hacking experience focused on Java/J2EE application security. |
| • Experience supporting a large-scale, public-facing enterprise application. |
| • Experience working in a DevSec or application security environment. |
| | | | |
| REQUIRED TECHNICAL / FUNCTIONAL SKILLS |
| • Core Java programming and strong understanding of Java application architecture and security practices. |
| • Hands-on web application penetration testing using manual and automated techniques. |
| • Ability to validate and exploit vulnerabilities and create/modify proof-of-concept exploits. |
| • Manipulation of URLs, query parameters, HTTP requests, browser data, tokens, sessions, and cache behavior. |
| • OWASP-related vulnerabilities and exploitation techniques, including SQL injection, XSS, authentication and authorization weaknesses. |
| • Hands-on use of Burp Suite and familiarity with Metasploit. |
| • Familiarity with Fortify on Demand SAST/DAST and MITRE ATT&CK. |
| • Understanding of cryptography and SSL/TLS. |
| • Scripting experience supporting penetration testing and security analysis. |
| • Ability to clearly document technical findings, exploitability, risk, evidence, and remediation. |
| | | | |
| KEY RESPONSIBILITIES |
| • Conduct hands-on penetration tests and vulnerability assessments of Java applications and supporting infrastructure. |
| • Identify application security weaknesses using manual and automated techniques. |
| • Simulate attacker techniques and develop or modify exploits to determine actual exploitability. |
| • Analyze workflows, authentication, authorization, sessions, tokens, browser data, URLs, query parameters, and other attack surfaces. |
| • Collaborate with Development teams to understand architecture, identify weaknesses, and provide remediation/secure coding guidance. |
| • Collaborate with Testing teams to integrate security considerations into manual and automated testing. |
| • Document findings, technical evidence, risk, business impact, and recommended corrective actions. |
| • Validate remediation through follow-up testing and retesting. |
| • Monitor relevant Java threats, vulnerabilities, and published NIST CVEs. |
| • Support secure SDLC improvement and application security standards/practices. |
| | | | |
| PREFERRED QUALIFICATIONS |
| • OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or comparable certification. |
| • Python, Bash, or other penetration-testing scripting experience. |
| • Secure Java code review experience. |
| • API penetration testing experience, including REST and/or SOAP. |
| • Cloud security testing and/or mobile application penetration testing. |
| • HIPAA or comparable regulated-environment knowledge. |
| • SCA/SBOM experience identifying vulnerable third-party components. |
| • AI-assisted security tools used to identify vulnerabilities or attack paths, with manual validation of exploitability. |
| | | | |
| CANDIDATE PROFILE |
| • Candidate should clearly explain a current/recent Java application they personally penetration tested, including application purpose and architecture. |
| • Candidate should distinguish their individual role and the penetration testing activities they personally performed. |
| • Candidate should provide specific examples of vulnerabilities personally identified, exploited, validated, documented, and retested. |
| • Candidate should explain hands-on Burp Suite use rather than relying solely on automated scanning. |
| • Candidate should demonstrate how Java development knowledge contributes to vulnerability identification and collaboration with Development. |
| • Candidate should distinguish Hands-on Experience, Working Knowledge, and Exposure. |
