What are the responsibilities and job description for the Application Pen Tester position at wellsfargo?
Description
Title:Application Pen Tester
Location: Charlotte, NC
Duration: 12 months
Work Engagement: W2
Work Schedule: Hybrid 3 days in office/2 days remote
Benefits on offer for this contract position: Health Insurance, Life insurance, 401K and Voluntary Benefits
Summary:
In this contingent resource assignment, you may: Consult on or participate in moderately complex initiatives and deliverables within Cyber Security Research and contribute to large-scale planning related to Cyber Security Research deliverables. Review and analyze moderately complex Cyber Security Research challenges that require an in-depth evaluation of variable factors. Contribute to the resolution of moderately complex issues and consult with others to meet Cyber Security Research deliverables while leveraging solid understanding of the function, policies, procedures, and compliance requirements. Collaborate with client personnel in Cyber Security Research. Required Qualifications: Cyber Security Research experience, or equivalent demonstrated through one or a combination of the following: work or consulting experience, training, military experience, education.
Key Responsibilities:
· Conduct application penetration testing across browser-based/web applications, APIs, and mobile applications (and where applicable mainframe and thick client applications) using primarily manual techniques supplemented by automated tools; include authentication/authorization testing and business-logic abuse cases where applicable
• Configure and tune automated tools to support testing, improve coverage, and accelerate discovery (as a complement to manual testing)
• Perform deep defect analysis by reproducing, validating, and safely demonstrating impact (including chained attack paths when applicable); triage and disposition false positives from automated tooling
• Produce clear, reproducible technical reports with evidence (steps to reproduce, impacted components/endpoints, and risk/impact) and practical remediation guidance
• Collaborate with application and security teams to ensure shared understanding of defects, prioritization, and remediation paths; support defect walkthroughs and follow-up questions as needed
• Support continuous improvement of testing methodologies and processes leveraging industry standards and best practices
• Collaborate with other members of the team to share knowledge and complete peer reviews of reports
• Communicate findings and risk clearly to technical and non-technical stakeholders; support readouts, status updates, and remediation Q&A
·
Key Requirements:
· Applicants must be authorized to work for ANY employer in the U.S. This position is not eligible for visa sponsorship.
Advanced experience with testing tools such as Burp Suite, Invicti, WebInspect, and Fiddler (and applying them to web, API, mobile, and thick client testing as applicable)
Cybersecurity Research experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• Hands-on application penetration testing experience (manual testing required), beyond reviewing/validating automated scanner results
• Dynamic Application Security Testing (DAST) experience, including tool configuration/tuning and manual verification of findings
• Strong knowledge of application security and common vulnerabilities (OWASP Top 10)
• Experience with scripting and automation (e.g., Python, Shell)
• Knowledge of security best practices and compliance standards (e.g., PCI DSS, GDPR)
• Excellent communication skills and the ability to collaborate effectively with cross-functional teams
• Strong problem-solving and analytical skills
• Demonstrated knowledge of AI/ML-enabled applications and common security risks (for example, prompt injection, sensitive data exposure, and insecure integrations)
• Security certifications such as OSCP, BSCP, GWAPT, GPEN, GXPN or equivalent are a plus