Vulnerability Senior Analyst

A-LIGN External · Remote, United States

In this role, you will be responsible for the delivery of external network, web application, and API penetration testing engagements. As the Penetration Tester, you will provide exceptional technical and client-focused testing strategies to help support the continued growth of our fast-paced company. A-LIGN will depend on you as the Penetration Tester to independently identify and validate real-world security risks, manually exploit vulnerabilities, document findings, and communicate practical remediation guidance to clients.
Director, Web Application & External Offensive Operations
Full-Time, Exempt
Execute external network, web application, and API penetration testing engagements
Evaluate findings in context, develop realistic attack paths, and accurately assess business and technical risk
Deliver clear, accurate, client-ready reports that explain findings, risk ratings, evidence, and actionable remediation guidance
Communicate technical issues, testing results, and remediation recommendations to client stakeholders
Maintain project quality and timelines while executing assigned engagements with minimal oversight
Mentor junior testers and contribute to the development of team capabilities and repeatable testing practices
Degree inin cybersecurity, computer science, a related discipline, or equivalent professional experience

5+ years of hands-on offensive security experience, including at least 3 years focused on external network, web application, or API penetration testing
~ Experience performing web application penetration testing using black-box, grey-box, and white-box approaches
~ Experience testing APIs, including REST, GraphQL, SOAP, or gRPC
~ Mobile application penetration testing experience across iOS or Android is preferred
~ White-box or source-code-assisted testing experience is preferred

Preferred:

OSWE, HTB CWEE, BSCP, eWPTX, CREST CCT APP, TCM PWPE, OSEP, or GXPN
Advanced manual testing skills, including the ability to chain lower-severity findings into high-impact attack paths
Advanced web exploitation knowledge, including access control and authorisation flaws, OAuth, SAML and JWT abuse, SSRF, deserialisation, request smuggling, race conditions, and business logic abuse
Knowledge of external attack surfaces, including OSINT, asset discovery, edge-device exploitation, and SSO or MFA attack techniques
Proficiency with scripting languages such as Python, Bash, JavaScript, PowerShell, or Go, including the ability to build custom tooling and exploits
Familiarity with common application frameworks, including Laravel, Express.js, ASP.NET Core, Spring, and Django
Ability to write clear, concise, client-ready reports with accurate risk ratings and actionable remediation guidance
Excellent verbal and written communication skills, with the ability to explain technical risks to technical and non-technical audiences
Ability to work independently and collaboratively in a fast-paced, remote environment while meeting deadlines.
Experience assessing AI or LLM-integrated applications for prompt injection, jailbreaks, data leakage, and agent or tool abuse is preferred
Familiarity with the OWASP Top 10 for LLM Applications and cloud attack surfaces across AWS, Azure, or GCP is preferred
Healthcare, Dental, and Vision Benefits
~ Employer Paid Life Insurance and Disability Insurance
~ EAP - Employee Assistance Program
~ Competitive Bonus Structure
~ Certification Reimbursement
~ Paid Office Closure December 25-January 1
~ Vacation Bonus
~ Summer Hours

Pathfynder by A-LIGN is a technology-enabled cybersecurity company providing offensive and defensive cybersecurity services under A-LIGN, a security and compliance partner trusted by more than 2,400 global organisations to help mitigate cybersecurity risks. Our proprietary compliance management platform is transforming the compliance experience by enabling an anytime, anywhere approach to audits. Apply online today at A-LIGN.com and learn about life at A-LIGN by following us on

LinkedIn.
Minorities, women, disabled individuals, and veterans are encouraged to apply.