Senior Web Application Penetration Tester

The role

The Senior Web Application Penetration Tester will conduct in-depth assessments of web applications, APIs, mobile applications, and supporting infrastructure. This role involves using custom tooling, manual testing, and advanced exploitation methodologies to identify vulnerabilities and attack paths.

What you will do

• Conduct penetration testing of web applications, APIs, mobile applications, databases, and client-side technologies.
• Perform application enumeration, endpoint discovery, vulnerability research, and exploitation activities.
• Identify, validate, and assess vulnerabilities across complex environments.
• Analyze attack paths and security weaknesses to determine business and operational impact.
• Develop and utilize custom tools, scripts, and payloads to support testing activities.
• Perform network mapping, vulnerability analysis, and security assessments across applications and supporting infrastructure.
• Research emerging vulnerabilities, attack techniques, and exploitation methodologies.
• Support post-exploitation activities involving cloud and enterprise environments when applicable.
• Collaborate with clients and internal teams to define scope, review findings, and recommend remediation strategies.
• Produce comprehensive reports including findings, exploitation procedures, risk analysis, and mitigation recommendations.

Required qualifications

• 5+ years of experience in web application penetration testing or offensive cybersecurity.
• Demonstrated experience conducting manual web application security assessments.
• Knowledge of modern web application vulnerabilities, attack methodologies, and exploitation techniques.
• Experience with network mapping, vulnerability scanning, and penetration testing methodologies.
• Familiarity with NIST 800-series standards and cybersecurity best practices.
• Experience developing scripts, payloads, or custom testing tools.
• Strong analytical, problem-solving, and communication skills.

Nice to have

• CWES
• CWEE
• OSCP
• OSWA
• OSWE
• CRTO
• GWAPT
• Other relevant hands-on offensive security certifications
• Experience with cloud environments and post-exploitation activities
• Experience with Active Directory security assessments

Benefits

• Employer-paid health insurance premiums (medical, dental, vision) for you and your family
• Employer-paid short/long term disability insurance and basic life/AD&D insurance
• 401K with a 4% employer contribution
• Professional development reimbursement options available (training, certification, education, etc)
• Flexible and remote work policies for most positions
• Flexible PTO and holiday schedule

Before you apply

• Must be able to obtain a Secret Clearance

About the company

SIXGEN delivers agile, mission-ready cybersecurity solutions to empower government and critical infrastructure organizations. They combine innovation and deep expertise to protect vital systems.