Application Security Engineer/Penetration Tester

Responsibilities

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities and logic flaws
• Perform hands-on penetration testing of web applications, microservices, and APIs
• Audit REST and GraphQL APIs with a focus on authentication, authorization, and business logic

Requirements

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing
• Hands-on experience with Semgrep, OpenGrep, Gitleaks, Trivy, and OSV-Scanner
• Proficiency with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetExec
• Deep understanding of OWASP Top 10 and OWASP API Security Top 10
• Knowledge of identity protocols including OAuth 2.0, OIDC, JWT, SAML, and RBAC/ABAC
• Intermediate level of English (spoken and written)

Preferred Qualifications

• Ability to read and analyze modern application code
• Understanding of AWS cloud security and Kubernetes (K8s) security fundamentals

About the Company

Growe values teamwork, driving results over process, and adaptability to change.