Penetration Tester

• Perform static (SAST), dynamic (DAST), and interactive (IAST) security testing across web, API, and cloud-native applications
• Conduct manual security testing to identify complex vulnerabilities, including business logic flaws and privilege escalation risks
• Analyze and validate findings from automated tools, prioritising risks based on impact and exploitability
• Assess application security against industry standards such as OWASP Top 10, CWE, and NIST frameworks
• Collaborate with development teams to provide remediation guidance and promote secure coding practices
• Support integration of security testing into CI/CD pipelines and DevSecOps workflows
• Provide input on threat modelling, secure design, and application architecture reviews
• Contribute to continuous improvement of application security processes and controls

Requirements

• Hands-on experience with SAST, DAST, and IAST tools and methodologies
• Strong understanding of web application architecture, APIs, authentication, and authorization mechanisms
• Experience using application security tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, or similar
• Familiarity with scripting or automation (e.g., Python, Bash, or JavaScript)
• Exposure to cloud environments and modern application development (e.g., microservices, containers)
• Knowledge of common vulnerability patterns and secure coding standards
• Relevant security certifications (e.g., OSCP, OSWE, GWAPT, CEH, CSSLP)
• Experience in DevSecOps environments and secure SDLC practices

Morgan Mckinley Pte Ltd

EA Licence No: 11C5502

EAP Registration No: R1106192