ZipRecruiter

Log In

1

Application Penetration Tester Jobs (NOW HIRING)

cFocus Software

NIH - Penetration Tester

Experience with network and application security assessments. * Experience documenting technical ... Conduct enterprise penetration testing activities including: * Perform internal and external ...

Total Cyber Solutions LLC

Penetration Tester

Springfield, VA · On-site

$100K - $140K/yr

GIAC Web Application Penetration Tester (GWAP) Company Description Total Cyber Solutions is a premier provider of Government Contracting, managed IT Services, and Cybersecurity Training. We help ...

Apply Early

next page

Showing results 1-20

All JobsApplication Penetration Tester Jobs

Application Penetration Tester information

See salary details

$96.5K

$132.3K

$159.5K

How much do application penetration tester jobs pay per year?

As of Jul 6, 2026, the average yearly pay for application penetration tester in the United States is $132,307.00, according to ZipRecruiter salary data. Most workers in this role earn between $121,500.00 and $146,500.00 per year, depending on experience, location, and employer.

What does a typical day look like for an Application Penetration Tester?

A typical day for an Application Penetration Tester involves planning and executing tests on web and mobile applications to identify security vulnerabilities, documenting findings, and collaborating with development or security teams to discuss remediation strategies. You might spend time replicating attack scenarios, reviewing code, and researching emerging threats or new testing methodologies. Regular team meetings and client briefings are common, especially when working on larger projects or audits. The work is highly dynamic, often requiring you to juggle multiple projects and stay current with evolving security best practices.

Is a penetration tester in demand?

Yes, application penetration testers are in high demand due to increasing cybersecurity threats and the need for organizations to identify vulnerabilities. The role often requires knowledge of security tools, scripting, and certifications like OSCP or CEH, and job growth is expected to remain strong as cyberattacks become more sophisticated.

What are the key skills and qualifications needed to thrive in the Application Penetration Tester position, and why are they important?

To thrive as an Application Penetration Tester, you need strong knowledge of application security, vulnerability assessment, and web technologies, typically supported by a degree in computer science, cybersecurity, or a related field. Familiarity with common penetration testing tools such as Burp Suite, OWASP ZAP, Kali Linux, as well as certifications like OSCP or CEH, is highly beneficial. Critical thinking, keen attention to detail, and clear written and verbal communication are essential soft skills for effective reporting and collaboration. These competencies ensure thorough security assessments, actionable findings, and effective teamwork to protect digital assets.

What is an application penetration tester?

An application penetration tester is a cybersecurity professional who evaluates the security of software applications by simulating cyberattacks to identify vulnerabilities. They use tools like vulnerability scanners and perform manual testing to help organizations strengthen their defenses and ensure application security compliance.

What is an Application Penetration Tester job?

An Application Penetration Tester is a cybersecurity professional who assesses the security of applications by simulating real-world attacks. They identify vulnerabilities, exploit weaknesses, and provide recommendations to improve security. Their work involves using automated tools and manual testing techniques to uncover risks. They collaborate with developers and security teams to ensure applications are protected against threats. This role requires knowledge of coding, common exploits, and security frameworks.

How to get into a penetration testing job?

To become an application penetration tester, develop strong knowledge of networking, operating systems, and security principles. Obtain relevant certifications such as Offensive Security Certified Professional (OSCP) or Certified Ethical Hacker (CEH), and gain hands-on experience through labs, internships, or bug bounty programs. Proficiency with tools like Kali Linux, Burp Suite, and Metasploit is also valuable.

Will pentesters be replaced by AI?

Application penetration testers perform manual and automated security assessments to identify vulnerabilities, and while AI tools can assist in detecting certain issues, they cannot fully replace the critical thinking, creativity, and contextual understanding that human pentesters provide. AI may augment the testing process but is unlikely to eliminate the need for skilled professionals in the foreseeable future.
More about Application Penetration Tester jobs
What cities are hiring for Application Penetration Tester jobs? Cities with the most Application Penetration Tester job openings:
What are the most commonly searched types of Application Penetration Tester jobs? The most popular types of Application Penetration Tester jobs are:
What states have the most Application Penetration Tester jobs? States with the most job openings for Application Penetration Tester jobs include:
What job categories do people searching Application Penetration Tester jobs look for? The top searched job categories for Application Penetration Tester jobs are:
What are popular job titles related to Application Penetration Tester jobs? For Application Penetration Tester jobs, the most frequently searched job titles are:
Application Penetration Tester jobs near you
Infographic showing various Application Penetration Tester job openings in the United States as of June 2026, with employment types broken down into 80% Full Time, and 20% Part Time. Highlights an 83% Physical, 3% Hybrid, and 14% Remote job distribution, with an average salary of $132,307 per year, or $63.6 per hour.
Application Penetration Tester

Application Penetration Tester

Strategic Staffing Solutions

Charlotte, NC • On-site

Other

Posted 25 days ago

Job description

Job Title: Application Penetration Tester

Locations: Charlotte, NC - Dallas,TX - Minneapolis, MN - Chandler, AZ - Des Moines, IA - Columbus, OH - Raleigh, NC - San Antonio, TX and Washington DC (Hybrid)

Duration: 12 Months

Job/Role Description:


  • This role focuses on identifying, validating, and exploiting security vulnerabilities through hands-on, manual penetration testing across a broad range of application technologies.
  • This position will conduct application penetration testing on browser-based/web applications, APIs, and mobile applications (mainframe and thick client experience a plus) using primarily manual techniques supplemented by automated tools, including authentication/authorization testing and business-logic abuse cases.
  • Perform deep defect analysis by reproducing, validating, and safely demonstrating security impact, including chained attack paths where applicable, while triaging and dispositioning false positives from automated tooling.
  • Configure and tune automated application security testing tools to improve coverage, accelerate discovery, and complement manual testing efforts.
  • Produce clear, reproducible technical reports with detailed evidence including steps to reproduce, impacted components/endpoints, risk/impact assessment, and practical remediation guidance.
  • Collaborate with application development and security teams to ensure shared understanding of defects, support prioritization, and drive timely remediation through defect walkthroughs and follow-up activities.
  • Support continuous improvement of penetration testing methodologies and processes by leveraging industry standards and best practices.
  • Collaborate with team members to share knowledge, complete peer reviews of reports, and strengthen overall testing capabilities.
  • Communicate findings and risks clearly to technical and non-technical stakeholders, supporting readouts, status updates, and remediation Q&A sessions.

Required Qualifications


  • 2+ years of hands-on application penetration testing experience with a strong emphasis on manual testing, beyond reviewing or validating automated scanner results
  • 2+ years of Dynamic Application Security Testing (DAST) experience, including tool configuration/tuning and manual verification of findings
  • 2+ years of Cybersecurity experience, or equivalent demonstrated through one or a combination of work experience, training, military experience, or education
  • Experience conducting penetration testing on browser-based/web applications and APIs required; experience with mobile, mainframe, or thick client applications a plus
  • Proficiency with application security testing tools such as Burp Suite, Invicti, WebInspect, and Fiddler a plus
  • Strong knowledge of common application security vulnerabilities and the OWASP Top 10
  • Experience with scripting and automation (e.g., Python, Shell) a plus
  • Knowledge of security best practices and compliance standards such as PCI DSS and GDPR preferred
  • Demonstrated understanding of security risks in AI/ML-enabled applications (e.g., prompt injection, sensitive data exposure, insecure integrations) a plus
  • Security certifications such as OSCP, BSCP, GWAPT, GPEN, GXPN or equivalent a plus
  • Excellent written and verbal communication skills with the ability to convey technical findings clearly to diverse audiences
  • Strong problem-solving and analytical skills
  • Proven ability to work effectively in a team-oriented, collaborative environment and partner with cross-functional teams
  • Ability to prioritize tasks and deliver high-quality results in a dynamic, fast-paced environment
  • Highly self-motivated and directed with strong organizational skills and keen attention to detail
  • Strong customer service orientation focused on delivering actionable insights and supporting timely remediation
  • This position offers a hybrid work schedule with consistent Monday Friday hours (flexible as long as schedule remains consistent)

Apply