Penetration Tester

About This Role

OnDefend is seeking an Application Penetration Tester who enjoys digging into applications, APIs, and supporting technologies to identify security weaknesses and help clients understand their risks. This role is for a hands-on tester who brings curiosity, attention to detail, and a willingness to keep building their technical skills. You will perform application security assessments using manual testing, source code review, and automated tools where appropriate.

Responsibilities

• Execute penetration tests of web applications, APIs, backend services, and related technologies across diverse client environments
• Assess cloud environments for IAM weaknesses, service misconfigurations and privilege escalation paths, including where application flaws can be used to gain access to underlying cloud infrastructure
• Work independently on assigned testing tasks and collaborate with other testers on larger or more complex engagements
• Test authentication, authorization, business logic, session management, input validation, and sensitive data handling
• Review application behavior, architecture, source code, and data flows to identify security vulnerabilities
• Use SAST, DAST, SCA, and other tools as appropriate, and manually investigate and validate potential findings
• Develop or adapt proof-of-concept scripts and lightweight tooling to demonstrate vulnerabilities when needed
• Validate findings, capture reproducible evidence, and prepare clear reports with practical remediation recommendations
• Maintain accurate testing notes and evidence, follow engagement scope and testing procedures, and communicate progress or blockers promptly
• Participate in peer review, share technical knowledge, and continue developing application security testing skills
• Work with engagement leads and other team members to clarify testing requirements, priorities, and technical questions

Requirements

• 3+ years of professional experience in application penetration testing, offensive security, or equivalent application security work
• Experience performing web application and API penetration tests within defined engagement scopes
• Hands-on manual testing experience with common vulnerabilities, including authentication and authorization flaws, IDOR/BOLA, injection, and business logic issues
• Working knowledge of HTTP, APIs, modern application architectures, and common application security weaknesses
• Proficiency with Burp Suite or comparable web security testing tools and ability to use or adapt proof-of-concept code
• Familiarity with SAST, DAST, and SCA tools and an understanding of when manual validation is needed
• Clear technical writing, attention to detail, and the ability to document reproducible findings and collaborate with clients and teammates