Cybersecurity Engineer / Application Security & Penetration Testing

Cybersecurity Engineer / Application Security & Penetration Testing

We are looking for an experienced Cybersecurity Engineer to join our client’s security organization and take an active role across penetration testing, application security, infrastructure security, vulnerability management, incident response, and operational resilience.

This is a hands-on technical security role combining offensive security and defensive security responsibilities. You will identify and validate real-world attack paths, integrate security into the software development lifecycle, strengthen infrastructure and identity controls, and work directly with engineering and operations teams to remediate vulnerabilities at their root cause.

The role also contributes to the organization’s cybersecurity risk-management and resilience program, including practical implementation of NIS2-related security measures, incident preparedness, supply-chain security, business continuity, disaster recovery, and evidence-based evaluation of security controls.

This position is offered through Tech Reserve, and the selected candidate will be employed by Tech Reserve while working on a long-term assignment for one of our enterprise clients.

Key Responsibilities

Penetration Testing & Offensive Security

• Plan and execute penetration tests across web applications, APIs, internal systems, internet-facing services, network infrastructure, and other critical components.

• Identify and validate business-logic vulnerabilities, authentication and authorization flaws, IDORs, injection vulnerabilities, SSRF, insecure deserialization, privilege-escalation paths, and other realistic attack scenarios.

• Conduct both authenticated and unauthenticated security testing.

• Participate in controlled adversarial and red-team exercises within clearly defined scopes.

• Produce clear technical findings including evidence, severity, business impact, and actionable remediation recommendations.

• Perform retesting and independently verify remediation rather than considering vulnerabilities resolved based solely on reported fix status.

Application Security & DevSecOps

• Introduce security-by-design principles and threat modeling for new systems, APIs, and significant architectural changes.

• Integrate and configure SAST, DAST, SCA/dependency scanning, secrets scanning, and other automated security controls within CI/CD pipelines.

• Define practical security gates that reduce risk without creating unnecessary friction in the software delivery process.

• Perform secure code reviews of critical components and work directly with developers to remediate root causes rather than individual symptoms.

• Apply OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, and appropriate secure coding practices according to the risk profile of each system.

• Assess and manage risks associated with third-party dependencies, open-source components, and the software supply chain.

• Work with SBOMs and dependency policies where appropriate.

Infrastructure Security & Vulnerability Management

• Build and maintain a continuous vulnerability management lifecycle, covering discovery, scanning, triage, prioritization, remediation ownership, SLAs, and retesting.

• Harden Linux and Windows servers, network services, databases, containers, remote-access systems, and other critical infrastructure.

• Review and improve network segmentation, firewall and WAF policies, administrative interfaces, remote access, and protection of internet-facing assets.

• Strengthen Identity and Access Management, including least privilege, privileged access, service accounts, MFA, joiner/mover/leaver processes, and periodic access reviews.

• Establish secure management of passwords, API keys, certificates, and other secrets.

• Identify and eliminate hardcoded credentials and support the adoption of centralized secrets-management solutions.

• Improve security logging, monitoring, detection use cases, and integrations with SIEM, EDR, WAF, and other defensive security controls.

• Review backup, restore, and disaster-recovery mechanisms from a ransomware and cyber-resilience perspective.

NIS2, Risk Management & Operational Resilience

• Support the practical implementation and ongoing maintenance of cybersecurity risk-management measures applicable to the organization, including risk analysis and security policies.

• Develop and maintain incident-response processes, including playbooks, escalation paths, evidence collection, lessons learned, and preparation for regulatory notification requirements following significant incidents.

• Support business continuity, backup, disaster recovery, and crisis-management processes through technical testing and tabletop exercises.

• Address supply-chain security, including security requirements for vendors, technical assessments, service criticality, outsourcing risks, and third-party access.

• Embed security into the acquisition, development, and maintenance lifecycle of systems, including vulnerability handling and coordinated remediation.

• Evaluate the effectiveness of security controls through technical testing, metrics, evidence, and recurring reviews rather than relying solely on documented policies.

• Support practical cyber-hygiene and security-awareness initiatives tailored to the real risks faced by different teams.

• Implement appropriate cryptographic and encryption practices for data in transit and at rest.

• Support asset-management processes and maintain visibility over critical systems, services, data, dependencies, and technical ownership.

• Prepare technical evidence for internal and external audits and collaborate with compliance and legal teams while maintaining a technically focused security function.

Incident Response & Security Operations

• Participate in the investigation of security incidents, including containment, eradication, and recovery activities.

• Perform technical analysis of logs, endpoints, network traffic, and other forensic artifacts when compromise is suspected.

• Develop detection and response playbooks for the organization’s most likely and highest-impact attack scenarios.

• Conduct purple-team activities together with infrastructure and monitoring teams to validate whether attacks can be detected and responded to effectively.

Requirements

• Strong hands-on experience in Cybersecurity Engineering, Application Security, Penetration Testing, or a similar technical security role.

• Practical experience performing penetration testing of web applications, APIs, infrastructure, and internet-facing systems.

• Strong understanding of common attack techniques including authentication/authorization flaws, IDOR, injection, SSRF, insecure deserialization, privilege escalation, and business-logic vulnerabilities.

• Good knowledge of OWASP Top 10, OWASP API Security, and OWASP ASVS.

• Experience with application-security tooling such as SAST, DAST, SCA, dependency scanning, and secrets scanning.

• Experience integrating security checks into CI/CD pipelines and working within DevSecOps environments.

• Ability to perform secure code reviews and work directly with developers on vulnerability remediation.

• Experience with vulnerability-management processes, including scanning, triage, prioritization, remediation tracking, and retesting.

• Strong understanding of infrastructure-security concepts including server hardening, network segmentation, firewalls, WAFs, containers, and remote-access security.

• Good understanding of IAM, MFA, privileged access, least privilege, service accounts, and secrets management.

• Experience with security monitoring technologies and concepts, including SIEM, EDR, logging, alerting, and detection engineering.

• Practical understanding of incident-response processes, including investigation, containment, eradication, recovery, and evidence collection.

• Understanding of backup, disaster recovery, ransomware resilience, and business-continuity principles.

• Familiarity with cybersecurity risk-management and regulatory security requirements, preferably including NIS2.

• Ability to translate technical vulnerabilities into clear business impact and actionable remediation recommendations.

• Strong documentation and communication skills and the ability to work effectively with engineering, infrastructure, operations, compliance, and business stakeholders.