ZipRecruiter

Log In

1

Web Pentester Jobs (NOW HIRING)

Pensar

Security Research Engineer

New York, NY · On-site

$120K - $175K/yr

Conduct original offensive security research across web, cloud, infrastructure, and AI/LLM attack ... Participate in architecture and design reviews with a focus on the pentester's workflow * Help ...

PensarAI, Inc.

Security Research Engineer

Manhattan, NY · On-site

$120 - $175/hr

Conduct original offensive security research across web, cloud, infrastructure, and AI/LLM attack ... Participate in architecture and design reviews with a focus on the pentester's workflow * Help ...

Cobalt

Cobalt Core Pentester - US Remote-Only

Perform manual penetration testing of web applications, APIs, internal and external networks, iOS and Android mobile applications * Work as a member of a pentest team, collaborating and engaging ...

previous page

Showing results 21-28

All JobsWeb Pentester Jobs

Web Pentester information

See salary details

$39K

$80.9K

$144K

How much do web pentester jobs pay per year?

As of Aug 12, 2026, the average yearly pay for web pentester in the United States is $80,851.00, according to ZipRecruiter salary data. Most workers in this role earn between $55,000.00 and $94,500.00 per year, depending on experience, location, and employer.

What is the difference between Web Pentester vs Penetration Tester?

AspectWeb PentesterPenetration Tester
CertificationsCEH, OSCP, GPENCEH, OSCP, GPEN
Work EnvironmentFocus on web applications and APIsBroader scope including networks, systems, and applications
Industry UsagePrimarily in cybersecurity firms, tech companies, and consultingIn various sectors including finance, government, and tech
Search & Comparison IntentSpecific to web security testingGeneral security testing across multiple domains

Web Pentesters specialize in testing the security of web applications and APIs, often requiring certifications like CEH or OSCP. Penetration Testers have a broader scope, assessing networks, systems, and applications. While Web Pentesters focus on web-specific vulnerabilities, Penetration Testers perform comprehensive security assessments across various environments.

What are the key skills and qualifications needed to thrive as a web pentester, and why are they important?

To thrive as a Web Pentester, you need strong knowledge of web application security principles, programming languages (such as JavaScript, Python, or PHP), and common vulnerabilities like OWASP Top 10, often supported by certifications like OSCP or CEH. Familiarity with penetration testing tools such as Burp Suite, OWASP ZAP, and Metasploit is typically required. Analytical thinking, attention to detail, and effective communication are essential soft skills to report findings and collaborate with development teams. These skills and qualifications are crucial for identifying, documenting, and mitigating web security risks to protect organizations from cyber threats.

What are some common challenges web pentesters face when conducting assessments for large organizations?

Web Pentesters working with large organizations often encounter challenges such as complex web application architectures, diverse technology stacks, and strict security protocols that limit testing methods. Coordinating with multiple teams, ensuring minimal disruption to business operations, and navigating change management procedures can also add complexity to the assessment process. Additionally, staying updated with the latest vulnerabilities and tools is crucial due to the rapidly evolving security landscape. Clear communication and thorough documentation are essential to ensure findings are well understood and remediation steps are actionable.

What is a web pentester?

Web pentesters, or web penetration testers, are cybersecurity professionals who assess the security of web applications by simulating cyberattacks. Their main goal is to identify vulnerabilities that malicious hackers could exploit and provide recommendations to strengthen the application's defenses. They use a combination of automated tools and manual testing techniques to evaluate issues like SQL injection, cross-site scripting, and authentication flaws. Web pentesters play a crucial role in helping organizations protect sensitive data and maintain the trust of their users.
More about Web Pentester jobs
What job categories do people searching Web Pentester jobs look for? The top searched job categories for Web Pentester jobs are:
Web Pentester jobs near you
Infographic showing various Web Pentester job openings in the United States as of August 2026, with employment types broken down into 1% Internship, 81% Full Time, 10% Part Time, 1% Temporary, and 7% Contract. Highlights an 82% Physical, 4% Hybrid, and 14% Remote job distribution, with an average salary of $80,851 per year, or $38.9 per hour.

Security Research Engineer

Pensar

New York, NY • On-site

$120K - $175K/yr

Full-time

Medical, Dental, Vision

Re-posted 10 days ago

Job description

We are seeking a Security Research Engineer to operate as a hybrid Forward Deployed Engineer and offensive security researcher. You'll be on the front lines of customer engagements - using our open source tool Apex to run pentests, curate and present findings, and stand up our platform inside customer environments. In parallel, you'll drive original offensive and open source security research, and feed everything you learn in the field back into the product so Pensar keeps getting sharper as a pentesting platform.
This role is customer-facing by design. The ideal candidate is equally comfortable in a terminal popping shells with Apex, on a Zoom with a CISO walking through findings, and in a design review arguing for the next product capability.
Key Responsibilities
Customer Engagements & Forward Deployed Work
  • Run end-to-end pentest engagements for customers using Apex, our open source offensive security tool
  • Curate, triage, and contextualize findings for customer audiences ranging from engineers to executives
  • Deliver clear, prioritized write-ups and walk customers through results, exploitation paths, and remediation
  • Set up and configure the Pensar platform inside customer environments, including integrations and workflows
  • Act as a trusted technical partner for customers throughout onboarding, engagements, and ongoing usage
  • Travel to customer sites as needed for kickoffs, readouts, and on-site testing
Offensive Security Research
  • Conduct original offensive security research across web, cloud, infrastructure, and AI/LLM attack surfaces
  • Develop new exploitation techniques, payloads, and tooling that extend Apex's capabilities
  • Build automated testing methodologies for emerging vulnerability classes and attacker tradecraft
  • Track the evolving threat landscape and translate it into concrete detections and capabilities
Open Source Security Research
  • Lead vulnerability research across high-impact open source projects and ecosystems
  • Verify findings, build proof-of-concept exploits, and coordinate responsible disclosure with maintainers
  • Contribute patches, advisories, and tooling back to the open source community
  • Grow Pensar's reputation in the security research community through publications, talks, and contributions
Product Feedback & Pentesting Roadmap
  • Translate firsthand engagement experience into concrete recommendations for the product roadmap
  • Partner with engineering and product on capabilities, UX, and automation that make pentesting faster and more reliable
  • Participate in architecture and design reviews with a focus on the pentester's workflow
  • Help shape Apex's direction as an open source project alongside the internal platform
Compensation
  • Base salary: $120,000 - $175,000 per year, depending on experience
  • Meaningful equity in an early-stage offensive security company
  • Final offers calibrated to depth of offensive security experience, the breadth of your research record, and the level you join at
Reports To
CEO / CTO
We are an equal opportunity employer committed to diversity and inclusion. We welcome applications from all qualified candidates regardless of race, gender, age, religion, sexual orientation, or disability status.
Requirements
  • 5+ years of experience in offensive security, pentesting, red teaming, or vulnerability research
  • Strong programming skills in multiple languages (Python, Go, JavaScript, C/C++)
  • Deep, hands-on understanding of modern vulnerability classes across web, cloud, and infrastructure
  • Proven track record of running pentest engagements end-to-end and delivering findings to customers
  • Excellent customer-facing communication skills - comfortable presenting to both engineers and executives
  • Experience contributing to or maintaining open source security tooling
  • Bachelor's degree in Computer Science, Cybersecurity, or related field, or equivalent experience
Preferred Qualifications
  • Experience with AI/LLM-assisted offensive security or building security automation on top of LLMs
  • Prior Forward Deployed Engineer, solutions engineering, or consulting experience at a security or developer tools company
  • Security certifications (OSCP, OSCE, OSWE, GXPN, or equivalent)
  • Public security research, CVEs, conference talks, or notable open source contributions
  • Experience with cloud security (AWS, GCP, Azure) and containerized environments
  • Familiarity with compliance frameworks (SOC 2, ISO 27001, PCI DSS) as they relate to pentesting

Benefits
  • Comprehensive health, dental, and vision insurance
  • Direct ownership of customer engagements and offensive research at an early-stage security company
  • Professional development budget for conferences, training, and certifications
  • Support for publishing research and presenting at industry conferences
  • Direct, visible impact on both our open source tooling and commercial platform

Apply