Application Security and Penetration Testing Engineer

About the role

We are seeking an experienced Application Security and Penetration Testing Engineer to strengthen the security of our enterprise web applications, APIs, and supporting services. This role will perform automated and manual security assessments, validate vulnerabilities, evaluate business risk, and collaborate with development teams to implement and verify remediation. The ideal candidate will combine hands-on penetration testing expertise with a strong understanding of application architecture, secure software development, and healthcare data security requirements.

Responsibilities

• Conduct security assessments of web applications, APIs, and related services using automated vulnerability-scanning and DAST tools.
• Perform manual penetration testing to identify vulnerabilities that automated tools may not detect.
• Test authentication, authorization, session management, access controls, input validation, file handling, APIs, and application business logic.
• Identify issues such as broken access control, injection vulnerabilities, cross-site scripting, insecure configurations, information exposure, and privilege escalation.
• Validate automated scan findings, eliminate false positives, and determine the exploitability and business impact of confirmed vulnerabilities.
• Document findings with clear technical evidence, reproduction steps, severity, risk, business impact, and remediation recommendations.
• Work with development and architecture teams to review findings and recommend practical corrective actions.
• Retest remediated vulnerabilities and formally confirm their closure.
• Support secure design reviews, threat modeling, code reviews, and release-readiness assessments.
• Help integrate application security testing into the software development lifecycle and CI/CD pipelines.
• Maintain vulnerability status, remediation timelines, risk exceptions, and security assessment reports.
• Support internal audits, customer security