Senior Specialist, MAST Application Penetration Tester

Join KPMG in Seattle for a hands-on, on-site role focused on MAST Application Penetration Testing. This position emphasizes independent work, practical testing of APIs, Web and mobile applications, and architecture reviews, with opportunities to present findings to diverse audiences. You will be rewarded with a competitive salary range of $95,855 to $208,265 per year and a culture centered on integrity, collaboration, and professional growth.

Benefits and culture

• Medical and dental plans
• Vision coverage
• Disability and life insurance
• 401(k) plans
• Personal well-being benefits
• Personal Time Off per fiscal year
• Calendar of holidays observed during the year
• Two breaks each year when Personal Time Off does not need to be used; one at year end and one around the July 4th holiday

Responsibilities

• Conduct manual penetration testing of APIs (REST/SOAP), Web Applications, Mobile applications, and thick client applications
• Plan and execute testing objectives within defined engagement scopes
• Perform threat modeling, assess business logic, and carry out architecture reviews
• Demonstrate testing expertise in real time through demonstrations to internal and external audiences
• Work independently on penetration testing engagements with minimal oversight
• Uphold KPMG values by acting with integrity, professionalism, and accountability in a respectful work environment

Requirements

• Minimum of three years of recent experience in application penetration testing of APIs, web applications, or mobile applications
• Bachelor's degree from an accredited college or university, or equivalent industry experience
• Ability to communicate reporting results to technical and non-technical audiences and lead remediation conversations
• Experience with Burp Suite Pro and other testing tools such as Netsparker and Checkmarx
• Preferred but not required: one or more major ethical hacking certifications (GWAPT, CREST, OSWE, OSWA)
• Ability to travel as required
• Authorized to work in the U.S. without the need for visa sponsorship now or in the future; no visa sponsorship is available for this opportunity

Technologies you will use include Burp Suite Pro, Netsparker, and Checkmarx.