ZipRecruiter

Log In

1

Web Application Penetration Tester Jobs (NOW HIRING)

Revolutional, LLC

Lead Penetration Tester

Kansas City, MO · On-site

$110 - $150K/hr

Lead Penetration Tester Location: Washington, DC, Ft. Collins, CO, or Kansas City, MO (project ... Web application security assessments (approximately 3-4 applications per year) * Test plan and ...

Amatriot Group, LLC

Penetration Tester

Rensselaer, NY · On-site

$90K - $105K/yr

Key Responsibilities Penetration Testing and Vulnerability Assessment * Conduct penetration tests ... Proficiency in web application security principles, including OWASP. * Knowledge of common web ...

Revolutional, LLC

Lead Penetration Tester

Washington, DC · On-site

$110 - $150K/hr

Lead Penetration Tester Location: Washington, DC, Ft. Collins, CO, or Kansas City, MO (project ... Web application security assessments (approximately 3-4 applications per year) * Test plan and ...

Amatriot Group, LLC

Penetration Tester

Rensselaer, NY · On-site

$90 - $105/hr

Key Responsibilities Penetration Testing and Vulnerability Assessment * Conduct penetration tests ... Proficiency in web application security principles, including OWASP. * Knowledge of common web ...

Amatriot Group, LLC

$90 - $105/hr

Key Responsibilities Penetration Testing and Vulnerability Assessment * Conduct penetration tests ... Proficiency in web application security principles, including OWASP. * Knowledge of common web ...

Chubb Life Fund

$90 - $130/hr

* Plan and execute penetration tests across web, mobile (iOS & Android), API, cloud-native ... Conduct mobile application security testing and reverse engineering, including hardcoded ...

Donato Technologies, Inc

Penetration Tester

Albany, NY · On-site

$60/hr

Proficiency in web application security principles (e.g., OWASP). * Knowledge of common web vulnerabilities (e.g., SQL injection, XSS) and exploit techniques. * Experience with penetration testing ...

Koniag, Inc.

Penetration Testing Lead

Leesburg, VA · On-site

GIAC Web Application Penetration Tester (GWAPT) * GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) * GIAC Assessing and Auditing Wireless Networks (GAWN) Blue Teaming Certifications:

kgs

Penetration Testing Lead

Leesburg, VA · On-site

GIAC Web Application Penetration Tester (GWAPT) * GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) * GIAC Assessing and Auditing Wireless Networks (GAWN) Blue Teaming Certifications:

previous page

Showing results 41-60

All JobsWeb Application Penetration Tester Jobs

Web Application Penetration Tester information

See salary details

$96.5K

$132.3K

$159.5K

How much do web application penetration tester jobs pay per year?

As of Sep 5, 2026, the average yearly pay for web application penetration tester in the United States is $132,307.00, according to ZipRecruiter salary data. Most workers in this role earn between $121,500.00 and $146,500.00 per year, depending on experience, location, and employer.

What is a web application penetration tester?

Web Application Penetration Testers are cybersecurity professionals who assess the security of web applications by simulating real-world attacks. Their goal is to identify vulnerabilities, such as SQL injection or cross-site scripting, that could be exploited by malicious actors. They use a mix of automated tools and manual testing techniques to uncover and report weaknesses, helping organizations improve the security of their web-based systems. These testers often provide recommendations for remediation and may work in-house or as external consultants.

What are the key skills and qualifications needed to thrive as a web application penetration tester, and why are they important?

To thrive as a Web Application Penetration Tester, you need a solid understanding of web technologies, common vulnerabilities (such as those in the OWASP Top 10), and relevant security concepts, often backed by degrees in computer science or related fields and certifications like OSCP or CEH. Familiarity with penetration testing tools like Burp Suite, Metasploit, and Nmap, as well as scripting languages such as Python or Bash, is typically required. Attention to detail, analytical thinking, and effective written and verbal communication are crucial soft skills for reporting findings and collaborating with clients or development teams. These skills ensure accurate vulnerability identification, clear documentation, and actionable recommendations, all vital for improving web application security.

What types of challenges might a web application penetration tester encounter when working with diverse client environments?

Web Application Penetration Testers often face the challenge of adapting to a wide range of application architectures, technology stacks, and security maturity levels across different clients. Each environment may have unique configurations, legacy systems, or undocumented features that require creative problem-solving and thorough reconnaissance. Additionally, testers must communicate complex technical findings to both technical and non-technical stakeholders, ensuring recommendations are clear and actionable. Effective time management and staying updated on emerging threats are essential for success in this dynamic role.

What is the difference between Web Application Penetration Tester vs Security Analyst?

AspectWeb Application Penetration TesterSecurity Analyst
CertificationsOSCP, CEH, GPENCISSP, Security+
Work EnvironmentHands-on testing, vulnerability assessmentsMonitoring, incident response, policy development
Industry UsageCybersecurity firms, tech companies, consultingCorporate security teams, government agencies

While both roles focus on cybersecurity, a Web Application Penetration Tester specializes in identifying vulnerabilities in web applications through active testing. In contrast, a Security Analyst monitors security systems, analyzes threats, and manages security policies. The roles often overlap in certifications and industry usage but differ in daily tasks and focus areas.

More about Web Application Penetration Tester jobs

What cities are hiring for Web Application Penetration Tester jobs?

Cities with the most Web Application Penetration Tester job openings:

What states have the most Web Application Penetration Tester jobs?

States with the most job openings for Web Application Penetration Tester jobs include:

What job categories do people searching Web Application Penetration Tester jobs look for?

The top searched job categories for Web Application Penetration Tester jobs are:

Web Application Penetration Tester jobs near you
Infographic showing various Web Application Penetration Tester job openings in the United States as of August 2026, with employment types broken down into 76% Full Time, 19% Part Time, and 5% Contract. Highlights an 90% Physical, 2% Hybrid, and 8% Remote job distribution, with an average salary of $132,307 per year, or $63.6 per hour.

External Network Penetration Tester

Xtreme Solutions Inc

San Bernardino, CA • Remote

Full-time

Re-posted 5 days ago

Job description

Description

Position Summary

Performs blind and intelligent penetration testing against internet-facing assets - web applications, firewalls, remote access (VPN/RDP), and internet postings - for all 47 County departments, attempting to obtain confidential/sensitive data using real-world threat intelligence-based techniques while evading detection.


Key Responsibilities

Conduct external network and web application penetration testing and vulnerability assessments per NIST SP 800-115 methodology.

Attempt to obtain ePHI, PII, financial data, and privileged communications from external sources without causing service disruption.

Document all findings with risk ratings, evidence, and remediation recommendations for the Assessment report.

Attempt to avoid detection and evade department response efforts during testing windows, as scoped.

Requirements

Required Qualifications

4+ years of hands-on external network / web application penetration testing experience.

Proficiency with industry-standard tools (Burp Suite, Nmap, Metasploit, or equivalent).

Strong understanding of OWASP Top 10 and common network attack vectors.


Preferred Qualifications

OSCP, GPEN, GWAPT, or CEH certification.

Experience testing government or healthcare-sector environments.


Travel

Fully remote; must remain within the continental United States.

Apply