Principal Ethical Hacker / Penetration Tester

Job Title: Principal Ethical Hacker / Penetration Tester



Client: Deloitte



Employment Type: W2 Contract



Location: Albany, NY Hybrid



Travel: Required to travel to Albany, NY twice per month Job Summary

Deloitte is seeking a highly skilled Principal Ethical Hacker / Penetration Tester with strong expertise in Java application security, penetration testing, secure coding, and DevSecOps . The ideal candidate will identify, exploit, assess, and help remediate vulnerabilities in enterprise-scale Java applications and infrastructure.

• Bachelor's degree in Computer Science, Information Security, or related field

• 6+ years of software development and/or security experience

• Strong Core Java programming experience

• Experience with penetration testing and ethical hacking

• Experience securing large-scale enterprise Java applications

• Strong knowledge of application security and OWASP

• Experience identifying SQL Injection, XSS, authentication, authorization, and other web vulnerabilities

• Hands-on experience with Burp Suite and Metasploit

• Experience with SAST/DAST tools, preferably Fortify on Demand

• Strong understanding of cryptography and SSL/TLS

• Experience with secure code review

• Scripting experience with Python and/or Bash

• Conduct penetration tests and vulnerability assessments for Java applications and infrastructure

• Identify security vulnerabilities through automated and manual testing

• Develop and use custom exploits to simulate attacker techniques

• Perform secure code reviews of Java applications

• Collaborate with development teams to identify security weaknesses early in the SDLC

• Work with testing teams to integrate security testing with manual and automated testing

• Provide secure coding guidance and remediation recommendations

• Monitor emerging Java security threats and vulnerabilities

• Review published CVEs and NIST security advisories

• Assess URLs, query parameters, browser tokens, cache mechanisms, and application data for attack vectors

• Evaluate production and non-production architectures

• Document security findings, risk assessments, and recommended remediation

• Communicate findings to technical and non-technical stakeholders

• Contribute to secure development policies and processes

• OSCP, GWAPT, GXPN, GPEN, LPT, CEH, CISSP, or similar certification

• Java secure code review experience

• API security testing

• Cloud security testing

• Mobile application penetration testing

• HIPAA/security compliance knowledge

• Familiarity with MITRE ATT&CK Framework