Delivery Senior Consultant, Penetration Tester

Join Deloitte as a Delivery Senior Consultant and Penetration Tester, contributing to the Cyber Defense & Resilience team from Lake Mary, Florida with a hybrid work arrangement. In this role you’ll perform both manual and automated security testing of web applications, APIs, and related systems, uncover vulnerabilities, and deliver remediation guidance to reduce risk. You will collaborate with developers and security colleagues to communicate findings and support remediation efforts.

Responsibilities

• Conduct both hands-on and automated security testing of web applications, APIs, and supporting infrastructure.
• Identify, validate, and document security weaknesses, including OWASP Top 10 items, with clear risk context.
• Execute authenticated and unauthenticated testing across development, test, and production-like environments.
• Evaluate authentication, authorization, session management, input validation, and encryption controls within applications.
• Produce concise, risk-based reports detailing technical findings, business impact, proofs of concept, and remediation guidance.
• Collaborate with developers, architects, and security teams to explain findings and support remediation efforts.
• Retest remediated issues and confirm closure of findings.
• Contribute to security standards, testing methodologies, and internal knowledge sharing initiatives.
• Stay informed about emerging threats, exploit techniques, and application security trends.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or another technical field.
• Ability to obtain and maintain the necessary security clearance for the role.
• Certifications: Offensive Security Certified Professional (OSCP), Offensive Security Web Expert (OSWE), GIAC Penetration Tester (GPEN), or Certified Ethical Hacker (CEH).
• At least 2 years of hands-on web application penetration testing experience.
• Strong understanding of web technologies including HTTP/S, REST APIs, JavaScript, cookies, headers, and session handling.
• Experience identifying vulnerabilities such as SQL injection, XSS, CSRF, SSRF, IDOR, authentication flaws, and access control weaknesses.
• Proficiency with testing tools such as Burp Suite, OWASP ZAP, Nmap, Postman, and related utilities.
• Experience writing professional penetration test reports for technical and non-technical audiences.
• Familiarity with OWASP Top 10, CWE, CVSS, and secure coding principles.

Delivery Center Location & Travel Requirements

• Hybrid work model requiring residence within commutable distance to a Deloitte Delivery Center location (Gilbert, Lake Mary, or Mechanicsburg) or Geo-Hub (Atlanta, Charlotte, Dallas, Houston, Philadelphia).
• Co-location up to 30% of working time at an assigned office for projects, training, and related activities.
• Travel up to 10% overnight for client or project engagements.
• Relocation required, with move completed within 12 weeks of the start date to reside within commuting distance.
• Must be legally authorized to work in the United States without sponsorship now or in the future.

Technologies

• Burp Suite
• OWASP ZAP
• Nmap
• Postman

The Team

Deloitte's Government & Public Services GPS practice serves federal, state, and local government clients as well as public higher education institutions. Our Cyber Defense & Resilience offering helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence, while managing dynamic attack surfaces and delivering rapid crisis and cyber incident response. This opportunity sits within the Deloitte US Delivery Center model, a delivery center approach that combines Deloitte scale with standardized processes to provide high-quality, cost-effective services across the firm. The USDC delivers a tight-knit, impactful environment with opportunities at locations nationwide and limited travel requirements.