Ethical Hacker/Penetration Tester Principal

sdna global is hiring a Java application security lead to strengthen products through real-world testing, clear remediation guidance, and incident support. This Ethical Hacker/Penetration Tester Principal role is hybrid in Albany, NY, with travel to Albany twice per month. You will help teams reduce risk across the SDLC by combining hands-on penetration testing with secure coding and vulnerability response.

What you’ll do

• Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure.
• Find weaknesses in Java code using automated and manual techniques.
• Build and use custom exploits to validate application security and simulate attacker tactics.
• Partner with Development teams to understand application architecture and surface security gaps early.
• Work with Testing teams to integrate security checks into both manual and automation testing.
• Provide secure coding guidance, including how to fix vulnerabilities.
• Stay current on Java security threats and best practices, and help strengthen secure development processes (SDLC).
• Support security incidents tied to Java vulnerabilities, including issues aligned to current published NIST CVE.
• Document and report findings with technical details, risk assessment, and recommended solutions.
• Communicate recommendations to technical and non-technical audiences.
• Contribute to security policies covering Java development and deployment.
• Explore penetration avenues by manipulating URLs, query parameters, and application browser data.
• Validate and assess browser tokens, including cache manipulation, and evaluate production vs non-production architecture.
• Apply MITRE ATT&CK Framework familiarity in testing and validation work.

What you’ll bring

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 6+ years in a Development and/or Security (Dev Sec) role.
• Strong core Java coding experience and knowledge of Java security practices.
• Experience in Penetration Testing and/or Ethical Hacking with a focus on Java application security.
• Background as an engineer and in Dev Sec work on a large-scale public enterprise application.
• Scripting experience and strong problem-solving and analytical skills.
• Web application security principles (including OWASP) and knowledge of common vulnerabilities such as SQL injection and XSS.
• Penetration testing tooling experience, including Burp Suite and Metasploit.
• Familiarity with Fortify on Demand (SAST and DAST tools).
• Strong understanding of cryptography and secure communication protocols such as SSL/TLS.
• Excellent communication skills and the ability to maintain confidentiality with high ethical standards.

Tools and technologies you’ll work with

• Java, Burp Suite, Metasploit
• Fortify on Demand, OWASP
• SQL injection, XSS
• SSL/TLS, MITRE ATT&CK Framework, NIST CVE

Preferred qualifications

• Security certifications such as OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or other industry security certifications.
• Experience with scripting languages such as Python and Bash.
• Experience with secure code review for Java.
• Familiarity with cloud security testing.
• Experience with mobile application penetration testing.
• Knowledge of regulations such as HIPAA.
• Experience with API testing.

Compensation: USD 55-60 per hour.