Principal Penetration Test Engineer

Principal Penetration Test Engineer – Application Security

********************US Citizens or GC Holders Only************************

********************US Citizens or GC Holders Only************************

********************US Citizens or GC Holders Only************************

Contract Opportunity | Competitive Hourly Rate | Senior / Principal Level

Sectech Solutions are seeking an experienced Principal Penetration Test Engineer for an opportunity with an established international technology organization.

This is a highly technical, hands-on position requiring a combination of advanced offensive security expertise and a strong software engineering background.

You'll lead complex application security assessments, identify and exploit vulnerabilities, review source code, and work directly with engineering teams to strengthen the security of enterprise software products.

Key Responsibilities

• Lead manual penetration testing of web applications, APIs, services and supporting infrastructure.
• Conduct detailed source code reviews to identify exploitable vulnerabilities.
• Perform threat modelling, security architecture assessments and secure design reviews.
• Identify, demonstrate and validate vulnerabilities, providing practical remediation guidance.
• Develop and adapt exploitation tools, scripts and testing methodologies.
• Collaborate with software engineering, application security and product teams.
• Support vulnerability disclosure, bug bounty triage and remediation validation.
• Provide technical leadership and contribute to the development of application security testing standards.

Essential Requirements

• 10+ years of IT experience , including at least 6 years in penetration testing or application security .
• Extensive hands-on experience in web application and API penetration testing .
• Strong software development or engineering background, with practical knowledge of Java, C#, Struts and Perl .
• Proven experience conducting source code security reviews .
• Experience with threat modelling (STRIDE, PASTA or equivalent) and secure software architecture reviews.
• Advanced knowledge of Burp Suite Professional, OWASP Top 10, OWASP API Security Top 10 and ASVS .
• Strong understanding of authentication, authorisation, OAuth2, OIDC, SAML and JWT.
• Experience identifying and exploiting injection, SSRF, deserialisation, access control and business logic vulnerabilities.
• Scripting experience with Python, Bash, PowerShell or Perl.
• Ability to communicate complex technical findings and advise developers on effective remediation.

Highly Desirable

• Experience with Jetty, Envoy Proxy and Alpine Linux.
• AWS, Docker, Kubernetes and CI/CD security experience.
• OSWE, OSCP, OSEP or GWAPT certification.
• Reverse engineering, exploit development or published vulnerability research.
• Previous experience leading application security assessments or mentoring security engineers.

Interested?

We're particularly interested in speaking with senior application penetration testers who have a genuine software engineering mindset and can operate confidently at both code and architecture level.

Please send your CV, expected hourly rate and availability to discuss the opportunity further.

Alternatively, reach out directly via LinkedIn.

********************US Citizens or GC Holders Only************************

********************US Citizens or GC Holders Only************************

********************US Citizens or GC Holders Only************************