Penetration Tester

Penetration Tester

About the company

Bright Security delivers an enterprise-grade, developer-centric DAST platform that helps organizations identify and remediate vulnerabilities early and continuously in the SDLC. The platform is widely used for security testing of web applications, APIs, business logic, and LLM-based solutions.

By integrating security testing into development workflows, Bright enables security and engineering teams to identify vulnerabilities earlier, improve collaboration, and accelerate remediation.

About the product

The company is developing a SaaS product that empowers Application Security & Development teams to find and fix vulnerabilities iteratively at every step in the SDLC, without slowing them down.

Position

We are looking for a curious, thorough, and hands-on Penetration Tester to help identify and validate security risks in web applications, APIs, business logic, and other modern application environments. This is a full-time, remote role. You’ll use both manual and automated techniques, going beyond scanner results to investigate how applications behave, explore attack paths, and uncover vulnerabilities through creative, methodical testing.

You’ll own assessments from scoping through testing, evidence collection, risk assessment, and reporting. You’ll also provide practical remediation guidance and retest fixes, with a strong focus on the quality and depth of every assessment.

Key responsibilities

• Performing thorough manual and automated penetration testing of web applications and APIs.
• Independently planning and executing assigned assessments with minimal supervision.
• Testing authentication, authorization, session management, access control, business logic, input handling, and API behavior.
• Identifying vulnerabilities through manual investigation, creative testing, and analysis beyond automated scanner output.
• Developing and validating practical proof-of-concept exploitation where appropriate.
• Producing clear, detailed, customer-ready penetration testing findings and reports.
• Providing practical remediation guidance and validating fixes through retesting.
• Contributing to testing methodologies, tooling, knowledge sharing, and continuous improvement.
• Supporting additional testing areas such as cloud, mobile, red team, and AI or LLM security depending on experience.

Qualifications

• Demonstrable hands-on experience with penetration testing, vulnerability research, bug hunting, bug bounty work, or comparable offensive security activities.
• Strong practical knowledge of web and API security, including OWASP Top 10, OWASP API Security Top 10, authentication, authorization, access control, and business logic vulnerabilities.
• Ability to perform meaningful manual testing rather than relying primarily on automated tools.
• Strong investigative mindset, attention to detail, and ability to identify non-obvious attack paths.
• Understanding of the complete penetration testing process, including methodology, evidence collection, validation, reporting, and retesting.
• Ability to work independently with little day-to-day handholding.
• Experience producing professional penetration testing reports with clear reproduction steps, impact, evidence, and remediation guidance.
• Very good to excellent written and spoken English, including customer-facing technical communication.
• Familiarity with tools such as Burp Suite, Nmap, Postman, browser developer tools, and relevant command-line tooling.
• Good understanding of HTTP, APIs, modern web architectures, networking, operating systems, authentication, and access control.
• Ability to use scripting or programming languages such as Python, JavaScript, Bash, or similar languages.

Advantageous Experience & Nice-To-Haves:

• Approximately 2 to 4 years of professional penetration testing, application security, or offensive security experience.

• Experience testing complex APIs, multi-tenant applications, authorization models, and business logic.

• Bug bounty participation or independently discovered vulnerabilities.

• Experience with cloud, mobile, network penetration testing, red team, or AI and LLM application security.

• Familiarity with DAST, SAST, CI/CD security testing, or DevSecOps environments.

• Relevant offensive security certifications.

• Skills Over Certifications: Certifications such as OSCP, OSWE, CPTS, PNPT, GWAPT, GPEN, or eWPT are welcome but not required and will not substitute for practical ability. Bright places greater value on demonstrated testing skill, depth, thoroughness, creativity, independence, reporting quality, and professional judgment. Practical Assessment Candidates progressing through the process will complete a hands-on penetration testing assessment against an authorized target selected by Bright Security.

• The assessment will evaluate practical testing ability, methodology, coverage, vulnerability identification and validation, depth of investigation, quality of evidence, reporting, and the ability to clearly explain findings and remediation recommendations.

Personal Attributes:

• Curious and investigative, with a drive to understand how an application works and where its assumptions might fail.
• Creative and persistent when exploring attack paths, including those that automated tools may miss.
• Thorough and attentive to detail, with sound judgment about which findings warrant deeper investigation.
• Self-directed and able to plan, prioritize, and complete assessments with limited oversight.
• Accountable for the accuracy, quality, and completeness of findings and reports.
• Clear and constructive when explaining technical risks and practical fixes to customers and colleagues.
• Collaborative and willing to share techniques, learn from peers, and improve testing methods.
• Ethical and disciplined when testing authorized systems and handling sensitive information.

What We Offer

• A global, remote-first working environment.
• Meaningful ownership over campaigns, marketing operations, and go-to-market initiatives.
• The opportunity to market an innovative cybersecurity product in a rapidly evolving category.
• Direct collaboration with company leadership, Product, Sales, and technical experts.
• A short path between proposing an idea and putting it into action.
• The opportunity to shape Bright’s marketing practices, channels, and positioning as the company grows.
• The opportunity to market an innovative cybersecurity product in a rapidly evolving category. Bright Security is an equal-opportunity employer and our team is composed of individuals from many diverse backgrounds, lifestyles, and locations.

Industry Software