Ethical Hacker/Penetration Tester Principal

sdna global is hiring a Java application security lead to strengthen products through real-world testing, clear remediation guidance, and incident support. This Ethical Hacker/Penetration Tester Principal role is hybrid in Albany, NY , with travel to Albany twice per month . You will help teams reduce risk across the SDLC by combining hands-on penetration testing with secure coding and vulnerability response. What you’ll do Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure. Find weaknesses in Java code using automated and manual techniques. Build and use custom exploits to validate application security and simulate attacker tactics. Partner with Development teams to understand application architecture and surface security gaps early. Work with Testing teams to integrate security checks into both manual and automation testing . Provide secure coding guidance , including how to fix vulnerabilities. Stay current on Java security threats and best practices , and help strengthen secure development processes (SDLC). Support security incidents tied to Java vulnerabilities , including issues aligned to current published NIST CVE . Document and report findings with technical details , risk assessment , and recommended solutions . Communicate recommendations to technical and non-technical audiences. Contribute to security policies covering Java development and deployment . Explore penetration avenues by manipulating URLs , query parameters , and application browser data . Validate and assess browser tokens , including cache manipulation , and evaluate production vs non-production architecture . Apply MITRE ATT&CK Framework familiarity in testing and validation work. What you’ll bring Bachelor’s degree in Computer Science, Information Security, or a related field. 6+ years in a Development and/or Security (Dev Sec) role. Strong core Java coding experience and knowledge of Java security practices. Experience in Penetration Testing and/or Ethical Hacking with a focus on Java application security . Background as an engineer and in Dev Sec work on a large-scale public enterprise application . Scripting experience and strong problem-solving and analytical skills. Web application security principles (including OWASP ) and knowledge of common vulnerabilities such as SQL injection and XSS . Penetration testing tooling experience, including Burp Suite and Metasploit . Familiarity with Fortify on Demand (SAST and DAST tools). Strong understanding of cryptography and secure communication protocols such as SSL/TLS . Excellent communication skills and the ability to maintain confidentiality with high ethical standards. Tools and technologies you’ll work with Java , Burp Suite , Metasploit Fortify on Demand , OWASP SQL injection , XSS SSL/TLS , MITRE ATT&CK Framework , NIST CVE Preferred qualifications Security certifications such as OSCP , GWAPT , GXPN , GPEN , LPT , CEH , CISSP , or other industry security certifications. Experience with scripting languages such as Python and Bash . Experience with secure code review for Java . Familiarity with cloud security testing . Experience with mobile application penetration testing . Knowledge of regulations such as HIPAA . Experience with API testing . Compensation: USD 55-60 per hour. #J-18808-Ljbffr Cybersecurity Jobs