Application Security Penetration Engineer

What you'll do

• Conduct manual vulnerability assessments and penetration testing across web applications, mobile apps, APIs, and microservices.
• Identify and validate security vulnerabilities across cloud-native services and AI/ML architectures.
• Engineer functional proof-of-concept code and exploit scenarios to demonstrate the tangible impact of security weaknesses.
• Research and apply LLM-based security testing techniques to uncover non-obvious vulnerabilities in Generative AI implementations.
• Document discovered vulnerabilities, reproduction steps, and attack chains in standardized assessment reports for technical and non-technical audiences.
• Propose actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers and stakeholders.
• Participate in threat modeling exercises and adversarial testing across traditional and AI-driven technology stacks.
• Research methods to automate penetration testing activities using AI/LLM tooling to improve testing effectiveness.

What we're looking for

• Minimum of 1-3 years of hands-on experience in penetration testing, application security assessment, or software development.
• Hands-on experience with dynamic/proxy/network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
• Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk.
• Strong foundation in enterprise programming and scripting languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
• Deep knowledge of application architectures, enterprise infrastructure, databases, middleware, and cloud computing (GCP, AWS, Azure).
• Deep knowledge of industry security standards including OWASP Top 10 and CWE/SANS Top 25.
• Working familiarity with emerging AI security standards including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related discipline (equivalent experience considered).
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.
• Exposure to AI security/adversarial testing tools such as Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) (preferred).