RemoteFull time
United States
Description
The Penetration Testing Engineer – Application Security is a mid-level role for a tester who has grown beyond the basics and can independently execute penetration tests within a primary domain of expertise. Engineers are offensive security subject matter experts – conducting full assessments with minimal supervision, contributing to methodology improvements, and acting as a point of contact for clients during engagements. By this stage, they are capable of scoping and planning a test in their domain, executing tests, and producing and communicating detailed reports with practical remediation advice.
Mid-level testers act as the technical client focal within engagements, leading technical execution for assigned projects.
Requirements
Typical Experience: ~3–5 years of penetration testing experience, during which they have performed numerous assessments. At this point, they have a track record of completed pen tests and proven competencies.
Domain Expertise: Mastery in at least one penetration testing domain. For example, an engineer might be an expert in Web Application Security – adept with advanced web vulnerabilities (beyond OWASP Top 10, including logic flaws, deserialization, etc.), skilled in using Burp Suite for complex testing, and possibly familiar with secure code review.
Technical Skills: Strong practical skills and tool usage. Mid-level testers are comfortable with a variety of pen testing tools and techniques. This includes network scanners (Nmap, Nessus), exploitation frameworks (Metasploit, Cobalt Strike), web testing suites (Burp Suite, OWASP ZAP), and scripting/programming to automate tasks or develop custom exploits (common languages include Python, PowerShell, or Bash). Understanding manual testing techniques – for example, crafting customized payloads, bypassing filters, or chaining vulnerabilities. An engineer at this level is often responsible for ensuring the accuracy of findings (minimal false positives) and may contribute new findings to the team’s knowledge base.
Soft Skills: Solid communication and consulting skills. By now, the engineer can write thorough technical reports that require only light review, translating technical findings into clear, actionable recommendations. They are also responsive and growing in client-facing abilities, able to lead client briefing calls, deliver vulnerability walkthroughs, and handle questions from stakeholders. Their time management and project coordination skills have improved, enabling them to handle multiple projects or deadlines.
Certifications (Optional): Many mid-levels pen testers obtain well-regarded certifications as a by-product of developing their skills. Examples include OSCP, GWAPT (Web Application Testing), GPEN (Network Penetration), OSWE (Web Exploit Developer), etc. These certifications reinforce their domain expertise, but hands-on experience and successful engagements remain the primary proof of competency.

Please refer the Job description for details