Sr. Application Security Engineer / Ethical Hacker

Sherwin-Williams is hiring a Senior Application Security Engineer to plan and execute application penetration testing across traditional and AI-enabled systems. In this role, you will validate and document vulnerabilities, partner with development teams on remediation, and help advance offensive testing practices through automation, custom tooling, and knowledge sharing.

What You’ll Do

• Translate functional, technical, and architectural requirements into application security assessment plans
• Create testing strategies and test plans based on application functionality, architecture, data flows, and identified risks
• Maintain advanced knowledge of application security testing methodologies, tools, and emerging attack techniques
• Research risks and testing techniques for both traditional applications and AI-enabled applications
• Find opportunities to improve penetration testing methodologies, testing effectiveness, and offensive security capabilities
• Evaluate, configure, and use offensive security tools to support application penetration testing
• Develop and maintain scripts, automation, and custom tools to improve testing efficiency and effectiveness
• Establish and maintain testing environments, payloads, and supporting technical resources
• Evaluate new application security and AI security testing tools and techniques
• Help define repeatable testing procedures, methodologies, and technical standards
• Plan and perform end-to-end penetration tests for traditional and AI-enabled applications
• Identify, exploit, validate, and document application security vulnerabilities
• Assess attack paths and application-specific risks that may not be uncovered by automated testing
• Communicate technical findings, risk, and remediation recommendations to stakeholders
• Retest applications to validate remediation of application security findings
• Review assessment results and provide technical guidance to other members of the Application Security team
• Track and report metrics related to assessment status, testing coverage, findings, and remediation progress
• Create and maintain penetration testing documentation, methodologies, runbooks, and standard operating procedures
• Mentor and provide technical guidance to less-experienced Application Security team members
• Participate in team planning, retrospectives, and knowledge-sharing activities
• Support Security Champions in reinforcing secure development and AI security practices
• Assist with evaluating security tools, technologies, and service providers
• Support project and task tracking and reporting as needed

Requirements

• Bachelor’s Degree (or foreign equivalent) or, in lieu of a degree, at least 12 years of experience in the field of Information Technology or Business (work experience or a combination of education and work experience in the field of Information Technology or Business)
• 5+ years of IT and/or cybersecurity
• 5+ years of application security experience, including hands-on penetration testing or offensive security assessments
• Advanced knowledge of Web applications, APIs, and common application security vulnerabilities
• Advanced knowledge of manual application penetration testing methodologies and techniques
• Advanced knowledge of authentication, authorization, session management, and application business logic
• Advanced knowledge of SDLC and secure development practices
• Advanced knowledge of AI architecture and model training processes
• Experience planning and conducting end-to-end application penetration tests, including cloud-native and other modern application architectures
• Experience identifying, exploiting, validating, and documenting application security vulnerabilities
• Experience developing scripts, automation, or custom tools using one or more languages
• Experience using application security and offensive security testing tools
• Experience communicating technical findings, risk, and remediation recommendations to technical and non-technical stakeholders
• Ability to work independently and collaboratively with development teams, security teams, and other stakeholders
• Experience mentoring and providing technical guidance to less-experienced professionals
• Experience conducting threat modeling and evaluating complex application attack paths
• Legally authorized to work in the United States without company sponsorship
• At least 18 years of age

Preferred Experience

• Offensive Security Certified Professional (OSCP) certification strongly preferred
• Experience testing AI-enabled applications, LLMa, or related technologies
• Experience performing security testing of mobile applications and legacy industrial systems
• Experience reviewing source code to identify security vulnerabilities
• Experience developing proof-of-concept exploits or modifying security testing tools
• Additional offensive security or application security certifications

Location: Cleveland, OH (remote). Compensation: USD 98,935 - 126,963 per year. Minimum Experience: 12 years.