Vulnerability Scanners

Vulnerability Scanners Cybersecurity Jobs

28 jobs found

Today

Offensive Security Analyst

Sprocket Security Madison, WI

Madison, WI

Today

Full time Application Security Cybersecurity Tools Dynamic Application Security Testing

Apply Now

Job Description

Sprocket Security is seeking an Offensive Security Analyst to act as the human judgment layer in an offensive automation pipeline for client-ready results.

Responsibilities

Triage, validate, and QA findings surfaced by Sprocket’s automation workflow
Reproduce and confirm true positives while eliminating false positives before results reach a client
Author and refine findings to client-ready quality, maintaining the Sprocket voice, then publish through the platform
Calibrate severity to real business impact using Sprocket standards, prioritizing practical impact over theoretical risk
Handle roughly 90% of findings independently, making accurate handle-versus-escalate decisions using platform workflow
Escalate the hard 10% to an Adversarial Engineer with full context attached
Provide pattern-level feedback to R&D and the Adversarial Engineering team to tune attack automations and reduce false positives
Log validation notes, flag false-positive patterns, and contribute to the knowledge base
Script away repetitive validation tasks wherever they appear
Collaborate with R&D and the Service Delivery team to improve the automation feedback loop and client experience
After triage is complete and capacity allows, help programmatically enhance the automation pipeline with new or updated capabilities, pairing with an Adversarial Engineer as needed
Attend daily standups, weekly 1:1s, monthly company calls, and all-hands

Requirements

Demonstrated experience triaging or reproducing vulnerabilities surfaced by a security tool (vulnerability scanner, SAST/DAST/SCA/IAST, or similar automation) in a professional setting
Some software programming experience, with Python preferred
Exposure to using Generative AI tools for day-to-day tasks, with Claude preferred
Strong Development, IT, or Infosec foundation plus genuine self-directed security study
Hands-on validation depth across common vulnerability classes, including OWASP Top 10, network, and authentication issues
Clear, detail-oriented written communication that remains effective under volume
Self-direction to manage a high-volume queue independently without hourly guidance

Technologies

Python
Claude
Generative AI
SAST
DAST
SCA
IAST
OWASP Top 10
Vulnerability scanner

Benefits

Unlimited and mandatory PTO for healthy work/life balance
Company matched 401k with immediate eligibility
75% company contribution for health insurance for employees and 50% for dependents
100% company contribution for dental and vision
Flexible working hours
Hardware and tools of your choice
Paid training, conferences, and certifications to support career development

Mission and Product Context

Company mission: help secure as many companies as possible by prioritizing penetration testing
Emphasis: offensive security for enterprises, building robust defense strategies based on individual business risk
Platform approach: an expert-driven Continuous Penetration Testing platform combining automated and manual testing
Your role: the human judgment layer who decides what is real, calibrates severity, and ensures findings read in the Sprocket voice before client delivery

Preferred

Security+, eJPT, CPTS, PNPT, or similar foundational credential
CTF achievements (HackTheBox, TryHackMe, PortSwigger Academy)
Degree in computer science, engineering, or IT
Interest in working toward OSCP or an equivalent hands-on certification over time

Location: Madison, WI (onsite)

View full job page →

3d ago

Offensive Security Analyst II

HEB Austin or San Antonio, TX

Austin or San Antonio, TX

3d ago

Full time Application Security Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

This hybrid role in Austin or San Antonio, TX focuses on offensive security testing, threat emulation, and remediation coordination for HEB.

Responsibilities

Identify and validate vulnerabilities through network penetration testing, web and mobile app testing, source code reviews, network segmentation assessments, and wireless network evaluations.
Assess security control effectiveness by conducting purple team exercises using both manual and automated techniques.
Prepare and present finding reports for technical and executive audiences to support remediation efforts.
Assist in identifying remediation options for discovered security issues.
Collaborate with Digital Compliance, Internal Audit, business teams, and internal and external penetration testing vendors to scope, schedule, validate, and execute offensive testing programs.
Coordinate with various stakeholders to plan and execute offensive testing activities.
Design, develop, document, optimize, and automate Windows, Linux, virtual lab environments, and cloud-based solutions to support offensive simulations.
Develop new offensive capabilities by designing and implementing automation and associated Windows, Linux, lab, and cloud resources.
Research emerging threats and threat emulation methodologies, keep current on industry trends, and pursue ongoing growth in technology, business knowledge, and internal policies.

Requirements

Minimum of 3+ years direct experience in penetration testing (web applications, hosts, networks), exploit development, fuzzing, and crafting countermeasures to identified vulnerabilities/risks.
Strong understanding of attack surfaces across web technologies, networks, modern applications (microservices/containers), and operating systems; ability to analyze closed-source applications using various off-the-shelf or custom tools.
Experience with tools such as Kali Linux, Metasploit, Burp Suite, Cobalt Strike, Tenable Nessus, WebInspect, IDA PRO, and Wireshark.
Experience with scripting and development languages (e.g., Bash, PowerShell, Python, Perl, Ruby, PHP, C/C++, C#, Java, etc.).
Experience testing across Windows, Linux, and cloud environments.
Working knowledge of information systems security standards and practices, including access control, system hardening, log monitoring, security policies, and incident handling.
Detail-oriented with strong problem-solving skills and the ability to anticipate potential issues.
Excellent verbal and written communication abilities.
Experience assessing APT threats, penetration testing, vulnerability management, attack methodologies, forensics techniques, malware analysis, attack surface comprehension, cyber threat emulation operations, and researching new APT TTPs.
Fundamental understanding of security testing for mobile, native applications, web applications, distributed systems, and databases.

Technologies

Kali Linux
Metasploit
Burp Suite
Cobalt Strike
Tenable Nessus
WebInspect
IDA PRO
Wireshark
Bash
PowerShell
Python
Perl
Ruby
PHP
C/C++
C#
Java
Windows
Linux
Cloud

Physical Demands & Working Conditions

Function in a fast-paced retail office environment.
Work extended hours and may require prolonged sitting.

View full job page →

3d ago

Penetration Tester

Galent Remote 🌍 Remote

Remote

3d ago

Full time Application Security Burp Suite Offensive Security

Apply Now

Job Description

Galent is seeking a skilled Penetration Tester to perform manual application security testing across APIs, Web, Mobile, and thick client applications, conduct threat modeling and architecture reviews, and clearly communicate findings to both technical and non-technical audiences.

Responsibilities

Conduct manual penetration testing across APIs (REST and SOAP), Web applications, mobile apps, and thick client software to identify security weaknesses.
Perform threat modeling, evaluate application business logic, and carry out architecture reviews to assess security posture.
Demonstrate testing capabilities in real time through demos for internal stakeholders and external clients.
Execute objective based and abstract penetration testing engagements with clearly defined scope and outcomes.
Develop and exploit proof of concepts to validate vulnerabilities and remediation approaches.
Operate independently on penetration testing engagements with minimal oversight and guidance.
Engage with technical and non-technical audiences to explain testing processes, techniques, and results; guide remediation options and assist clients in weighing these options.

Requirements

Minimum 5 years of recent hands-on experience in application penetration testing covering APIs, web applications, and mobile applications.
Proven ability to communicate reporting results to technical and non-technical audiences and lead remediation conversations.
Experience with Burp Suite Pro and other application testing tools such as Netsparker.
Bachelor's degree from an accredited college or university, or equivalent industry experience.
One or more major ethical hacking certifications are preferred but not required; examples include GWAPT, CREST, OSWE, OSWA.

Technologies

Burp Suite Pro
Netsparker

Location

Remote

View full job page →

3d ago

Penetration Tester

Egis Systems, LLC Remote 🌍 Remote

Remote

3d ago

$88k - $100k/yr Full time Application Security Burp Suite Cybersecurity Tools

Apply Now

Job Description

Egis Systems, LLC is seeking an entry level Penetration Tester to perform scoped engagements under supervision, applying Fortified’s methodology to network, system, and application targets. The role emphasizes documenting findings for formal deliverables, pursuing security certifications, and developing foundational exploitation skills alongside professional communication.

Compensation

Salary: USD 88,000 – 100,000 per year.

Location

Remote

Responsibilities

Execute scoped penetration testing engagements under supervision, covering internal, external, wireless, and application targets, in alignment with Fortified’s methodology.
Produce accurate, well-documented findings including formal reports, notes, presentations, and appendices, delivered on schedule and reviewed by an IC2 or IC3 practitioner before client submission.
Report project performance metrics to the Penetration Testing Manager or assigned IC2/IC3 lead; proactively flag delivery risks or blockers.
Maintain foundational awareness of current threats, vulnerabilities, and exploitation techniques across networks, systems, and applications; develop technical depth over time.
Pursue relevant industry certifications, with eJPT or CEH as an entry baseline and OSCP targeted within 18 months of hire as a near-term development goal.
Demonstrate working familiarity with tools such as Kali Linux, Metasploit, NMAP, Burp Suite (Community), and Nessus; continue building proficiency through hands-on engagement work.
Apply penetration testing methodologies including OWASP, PTES, NIST SP800-115, and MITRE ATT&CK under supervision; understand how methodology and scope influence engagement outcomes.
Maintain working knowledge of networking technologies, protocols, and network functionality as they relate to penetration testing scope and attack surface analysis.
Follow Fortified’s rules of engagement and procedures to detect, identify, and exploit vulnerabilities across operating systems, applications, and hardware with minimal client impact.
Collaborate effectively within a team; communicate engagement status, blockers, and findings to oversight during active projects.
Provide routine client status updates on a daily or weekly cadence as directed; client communications are reviewed by an IC2 or IC3 practitioner before delivery during the first 90 days and until independent communication readiness is confirmed.
Accurately record and submit time by required deadlines.
Monitor communications from Fortified personnel; participate in mandatory training and team and departmental meetings.
Arrange travel in compliance with company and client travel policies.
Maintain detailed documentation of customer interactions, engagement actions, and testing notes throughout each project.
Show awareness of social engineering concepts and their role in engagements; support social engineering components within defined scope as directed.
Maintain familiarity with Fortified’s core service offerings and make appropriate client recommendations based on those offerings.

Requirements

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent hands-on experience.
Minimum of 2 years of security or IT experience; lab-based experience and CTF participation accepted at entry level.
Healthcare IT experience is a plus.
Strong computer skills in Adobe and Microsoft Office applications (Project, Visio, Word, Excel, PowerPoint).
Solid understanding of hardware and networking terminology and devices.
Experience with network security, topology, networking technologies and OSI Model understanding.
Thorough understanding of current security principles, techniques, and protocols.
Familiarity with generating and troubleshooting PowerShell, Bash, or Python scripts.
Ability to work and communicate effectively, professionally, and positively with clients, third-party vendors, and other departments.
Professionalism and diplomacy to build and maintain relationships throughout the project and beyond.
Excellent interpersonal skills, with strong written and verbal communication abilities.
Resourceful and proactive in developing and completing work assignments.
Strong problem-resolution and critical thinking skills; flexible and self-starting.
Ability to retain and protect confidential material.
Baseline requirement of eJPT or CEH; OSCP strongly preferred and expected to be actively pursued within 18 months of hire as a signal for promotion readiness.
Foundational skills in Kali Linux, Metasploit, and Burp Suite (Community); basic scripting in Python or Bash; foundational understanding of social engineering tactics and their application in engagements.

Technologies

Kali Linux
Metasploit
NMAP
Burp Suite (Community)
Nessus
PowerShell
Bash
Python

Working Conditions & Travel

Evenings and weekend hours may be required. Travel as needed.

View full job page →

3d ago

Senior Penetration Tester

Govcio LLC Washington, DC

Washington, DC

3d ago

$125k - $180k/yr Full time Senior Application Security Cloud Platforms

Apply Now

Job Description

Govcio LLC is seeking a Senior Penetration Tester to lead advanced security testing efforts within TS/SCI environments, delivering hands-on assessments and remediation guidance for DHS-related work in Washington, DC. The role blends deep technical expertise with leadership responsibilities to strengthen security across systems, networks, cloud resources, and web applications.

Responsibilities

Plan, lead, and supervise penetration testing across on‑premises systems, networks, cloud resources, and web applications within a TS/SCI environment.
Carry out thorough vulnerability assessments and software assurance reviews, clearly documenting findings and guiding remediation strategies.
Perform in‑depth analysis of security weaknesses, including buffer overflows, SQL injection, CSRF, XSS, TOCTOU race conditions, XXE, encryption flaws, and authentication bypass issues.
Evaluate security considerations during software acceptance activities, defining criteria, assessing risk acceptance, reviewing documentation, and applying independent validation approaches.
Apply advanced defense functions such as encryption, access control, and identity management to reduce exploitation risks, including supply chain concerns.
Provide threat intelligence and vulnerability research aligned with NIST 800‑53 and MITRE ATT&CK to inform cloud security architecture decisions.
Develop new or enhanced penetration testing methodologies to identify emerging vulnerabilities and expand organizational capability.
Act as a senior technical advisor and mentor to the penetration testing team, ensuring consistency, quality, and rigor in testing efforts.
Represent the penetration testing function in discussions with leadership, engineering teams, and mission stakeholders as required for Key Personnel roles.

Requirements

Bachelor’s degree and 12+ years of penetration testing experience, or equivalent.
Minimum 8 years supporting enterprise security architectures and cloud platforms (AWS, Azure, Google Cloud).
Proven, extensive experience as a Penetration Tester in complex or classified environments.
Advanced knowledge of penetration testing methodologies, offensive security techniques, and industry tools.
Experience with AWS, Azure, RHEL, Linux, and Tenable.
Hands‑on experience with Kali Linux, Burp Suite Pro, and Metasploit.
Strong analytical and problem‑solving skills with the ability to think like an attacker.
Excellent communication skills for delivering clear, actionable findings to technical and executive stakeholders.
Preferred certifications: CEH, OSCP, or equivalent offensive security credentials.
Active TS/SCI clearance is required.

Technologies

AWS
Azure
Google Cloud
RHEL
Linux
Tenable
Kali Linux
Burp Suite Pro
Metasploit
MITRE ATT&CK
NIST 800-53

Overview

Govcio LLC is seeking a Senior Penetration Tester with an active TS/SCI clearance to support DHS onsite in Washington, DC.

View full job page →

4d ago

Penetration Tester

Trofi Security Lafayette, CO

Lafayette, CO

4d ago

Full time Application Security Cybersecurity Tools Information Security

Apply Now

Job Description

The Penetration Tester role at Trofi Security is an onsite position based in Lafayette, Colorado. The role centers on planning and executing information security testing, including black box, grey box, and white box assessments, with a strong emphasis on hands-on exploitation, vulnerability discovery, and communicating findings clearly. A minimum of five years of information security and penetration testing experience is required.

Responsibilities

Plan and execute information security testing across black box, grey box, and white box engagement models.
Perform hands-on exploitation and vulnerability discovery, and clearly communicate findings to stakeholders.
Apply creative problem solving and rigorous methodology to identify security weaknesses within authorized scope.
Demonstrate the ability to operate independently or as part of a team to deliver testing engagements.

Requirements

5+ years of information security experience with application and network penetration testing.
Deep understanding of web frameworks, including XML, SOAP, JSON, and AJAX.
Experience with scripting languages such as Bash, Perl, Python, Ruby, VBScript/WScript, or PowerShell.
Experience exploiting web applications and services.
Working knowledge of firewalls and other network security products.
Experience with .NET web application frameworks and languages.
Understanding of C, C#, Objective-C, and Java.
Familiarity with web proxy tools.
Familiarity with penetration testing tools such as Kali Linux, Nexpose, Nessus, Nmap, Metasploit, vulnerability scanners, tcpdump, and Wireshark.
Excellent written and oral communication skills.
Self-motivated and able to work both independently and with a team.
Willing to travel up to 50% of the time.

Technologies

XML
SOAP
JSON
AJAX
Bash
Perl
Python
Ruby
VBScript / WScript
PowerShell
.NET
C
C#
Objective-C
Java
Web proxy tools
Kali Linux
Nexpose
Nessus
Nmap
Metasploit
tcpdump
Wireshark
Rapid7 Nexpose
BurpSuite Pro
OSSTMM
OWASP
NIST Special Publications

Highly Desirable Skills and Qualifications

Familiarity with Open Source Security Testing Methodology Manual (OSSTMM), OWASP, and NIST Special Publications.
Experience using Rapid7 Nexpose and Metasploit, and BurpSuite Pro.
Experience leading or participating in Red Team engagements.
Knowledge of applied cryptographic protocols.
Certifications such as CEH, CPT, CISSP, OSCP/E, GWAPT, GPEN, GXPN.
Experience with debuggers and disassemblers.
Experience in exploit development.
Experience in hardware hacking or embedded systems hacking.
Advanced degree in an IT-related field is a plus.

View full job page →

4d ago

Cybersecurity Red Team-Penetration Tester

Zions Bancorporation Midvale, UT

Midvale, UT

4d ago

Full time Adversary Testing Application Security Cloud Platforms

Apply Now

Job Description

Zions Bancorporation offers a hybrid Cybersecurity Red Team-Penetration Tester role in Midvale, UT that emphasizes proactive defense and real-world impact. You will identify and exploit complex vulnerabilities across enterprise infrastructure, applications, and cloud environments, design and execute simulated attacks, and collaborate with Incident Response and development teams to strengthen security posture from day one.

Benefits

Medical, Dental and Vision Insurance starting on Day One
Life and Disability Insurance, Paid Parental Leave and Adoption Assistance
Health Savings (HSA), Flexible Spending (FSA), and dependent care accounts
P aid Training, Paid Time Off (PTO) and 11 Paid Federal Holidays
401(k) plan with company match, Profit Sharing, competitive compensation aligned with experience
Mental health benefits including coaching and therapy sessions
Tuition Reimbursement for qualifying employees
Employee Ambassador preferred banking products

Work Location

This position offers a hybrid work from home arrangement with a minimum of three days per week in the office at the new Zions Technology Center in Midvale, UT. The 400,000-square-foot campus sits on the former Sharon Steel Mill superfund site and serves as the company’s primary technology and operations hub. Key features include:

Electric vehicle charging stations and proximity to Historic Gardner Village UTA TRAX station
At least 75% of building power from on-site renewable solar energy
Access to outdoor recreation, parks, trails, shareable bikes and locker rooms
Large modern cafe with a healthy and diverse menu
Healthy indoor environment with ample natural light and fresh air
LEED-certified sustainable building with low VOC-emitting construction materials

Responsibilities

Emulate Advanced Adversaries: Lead comprehensive red team operations and objective-based testing to simulate real-world cyberattacks, evaluating technical controls and incident response readiness
Conduct Multidisciplinary Testing: Perform manual and automated penetration testing across web applications, APIs, cloud environments (AWS/Azure/Kubernetes), internal/external networks, and operating systems (Windows, Active Directory, Linux)
Audit and Attack AI Systems: Design and execute adversarial simulations against Large Language Models and machine learning pipelines to identify enterprise vulnerabilities and ensure resilience of AI applications
Develop Custom Exploits: Create, modify, and optimize scripts and tools to bypass modern EDR agents and navigate restricted environments
Deliver Clear Reporting: Translate complex findings into detailed remediation reports and present risk impact clearly to technical developers and non-technical stakeholders
Collaborate for Remediation: Partner with Cyber Threat Intelligence, Incident Response, Detection Engineering and development teams to provide post-assessment debriefs, validate remediation efforts, and strengthen overall security posture

Requirements

Adversarial Frameworks: Deep practical knowledge of MITRE ATT&CK, OWASP Top 10, and NIST
AI & LLM Vulnerability Exploitation: Practical understanding of LLM top risks and hands-on experience with prompt injection, training data poisoning, model inversion, and API-based data exfiltration
Commercial & Custom Tooling: Proficient use of offensive security suites and platforms such as Cobalt Strike, Burp Suite, Nessus, Nmap, Metasploit, BAS, and related tooling
Active Directory Domain Dominance: Proven experience exploiting AD environments including Kerberos roasting, AS-REP roasting, pass-the-hash, golden/silver tickets, and domain delegation flaws
Scripting & Automation: Strong programming skills in Python, PowerShell, Bash, or Go to automate tasks and build tooling
Cloud Security: Experience identifying misconfigurations and exploiting AWS, Azure, or Kubernetes/Docker environments
Professional Experience: 5+ years focusing on network penetration testing, application security testing, or red teaming
Educational Background: Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related field, or equivalent hands-on experience
Certifications: OSCP or OSCE/OSEP; SANS/GIAC certifications (GPEN, GXPN, GWAPT); HTB CPTS