Application Penetration Tester

About the role

dysrupit is looking for an Application Penetration Tester to assess web, mobile and API-based applications for security weaknesses. You will plan and run tests, document findings clearly and help engineering teams fix issues before attackers find them. Engagements are for Australian clients, so familiarity with local data protection and cyber compliance requirements is a strong advantage.

Key responsibilities

• Plan and carry out black-box, grey-box and white-box penetration tests on web applications, APIs and mobile apps
• Find and safely exploit vulnerabilities such as injection flaws, broken authentication and access control, business logic flaws and insecure configurations
• Combine manual testing with automated scanning and validate results to remove false positives
• Write clear reports with risk ratings, proof of concept, business impact and remediation steps
• Present findings to technical and non-technical stakeholders and retest fixes
• Map findings to relevant standards and client compliance obligations, and support secure code review and threat modelling
• Stay up to date with new attack techniques, tools and vulnerabilities

Required profile

• 3-5 years of hands-on application penetration testing experience
• Strong written English and report-writing skills
• Ability to work independently and meet engagement deadlines

Required skills

• OWASP Top 10, OWASP ASVS and OWASP API Security Top 10
• Burp Suite, Nmap, SQLmap, Postman, Frida, MobSF
• OAuth 2.0, OIDC, JWT, SAML
• Python, Bash or similar scripting
• AWS, Azure or GCP