Penetration Tester

About the role

Bright Security is seeking a remote Penetration Tester to join its security team. You will lead security assessments of web applications, APIs, business logic, and LLM‑based components, combining manual expertise with automated tooling. The role collaborates closely with product, development, and security engineers to embed findings into the company’s developer‑centric workflows.

Key responsibilities

• Plan and execute security assessments on web applications, APIs, business logic, and LLM‑based components using manual and automated techniques.
• Identify, validate, and document vulnerabilities, reproduce issues with engineering teams, and propose remediation steps.
• Develop and maintain test methodologies, contribute to security tooling, and participate in red‑team exercises.
• Collaborate with product, development, and security teams to embed findings into Bright’s developer‑centric workflows.
• Stay up‑to‑date with emerging threats, exploitation techniques, and industry best practices.

Required profile

• Strong application security knowledge, including secure coding concepts and OWASP Top 10 web and API vulnerabilities.
• Hands‑on experience with penetration testing, red‑team operations, and offensive security reporting.
• Proficiency in reverse engineering, malware analysis, and understanding of exploit payloads and evasion.
• Solid fundamentals in network security, operating‑system internals, authentication/authorization, and encryption.
• Ability to produce clear technical reports and communicate risk to both technical and non‑technical audiences.
• Comfort working independently in a remote, distributed team across time zones.

Required skills

• Python (scripting/automation)
• JavaScript or similar programming language
• OWASP Top 10 knowledge
• DAST and SAST tools
• CI/CD pipeline integration
• Reverse engineering and malware analysis
• Network security concepts
• Operating‑system internals
• Authentication and encryption basics