JOB SUMMARY
We are looking for an Application Penetration Tester to assess web, mobile, and API-based applications for security weaknesses. You will plan and run tests, document findings clearly, and help engineering teams fix issues before attackers find them. You will work on engagements for Australian clients, so familiarity with local data protection and cyber compliance requirements is a strong advantage.
JOB RESPONSIBILITIES
- Plan and carry out penetration tests on web applications, APIs, and mobile apps (black-box, grey-box, and white-box).
- Find and safely exploit vulnerabilities such as injection flaws, broken authentication and access control, business logic flaws, and insecure configurations.
- Perform manual testing alongside automated scanning, and validate results to remove false positives.
- Write clear, accurate reports with risk ratings, proof of concept, business impact, and practical remediation steps.
- Present findings to technical and non-technical stakeholders.
- Retest fixes and confirm that issues are closed.
- Map findings to relevant standards and client compliance obligations.
- Support secure code review and threat modelling where needed.
- Keep up with new attack techniques, tools, and vulnerabilities.
JOB QUALIFICATIONS:
- [3–5]+ years of hands-on application penetration testing experience.
- Strong knowledge of the OWASP Top 10, OWASP ASVS, and OWASP API Security Top 10.
- Proficiency with Burp Suite and common testing tools (e.g., Nmap, SQLmap, Postman, Frida, MobSF).
- Working knowledge of authentication and authorization standards (OAuth 2.0, OIDC, JWT, SAML).
- Scripting ability in Python, Bash, or similar.
- Understanding of cloud environments (AWS, Azure, or GCP) and how they affect application security.
- Strong written English and report-writing skills.
- Ability to work independently and meet engagement deadlines.
Skills Required
- 3-5+ years of hands-on application penetration testing experience
- Strong knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security Top 10
- Proficiency with Burp Suite, Nmap, SQLmap, Postman, Frida, and MobSF
- Working knowledge of OAuth 2.0, OIDC, JWT, and SAML
- Scripting ability in Python, Bash, or similar
- Understanding of AWS, Azure, or GCP cloud environments and application security implications
- Strong written English and report-writing skills
- Ability to work independently and meet engagement deadlines
- Familiarity with Australian data protection and cyber compliance requirements
What We Do
DysrupIT is a technology consultancy that helps organizations understand their operations, make better use of existing technology, and build capabilities for future needs. Its work spans consulting, execution, managed services, and staff augmentation, with services including cloud, cybersecurity, application engineering, data analytics, and IT service management. The company also supports AI strategy and implementation, aiming to help clients transform, improve processes, and achieve business outcomes.
