Senior Application Security Engineer

York Solutions, LLC is seeking a Senior Application Security Engineer to focus on application penetration testing in large enterprise environments. The role involves executing end-to-end penetration tests and collaborating with engineering teams to identify and remediate vulnerabilities.

Responsibilities:

• 7+ years of hands-on penetration testing experience, focused on web applications and APIs in large enterprise environments
• Demonstrated experience executing end-to-end penetration tests (scoping, exploitation, validation, reporting)
• Strong working knowledge of web application vulnerabilities (e.g., OWASP Top 10, authentication/authorization flaws, injection attacks)
• Proficiency with core security testing tools, including Burp Suite (advanced usage required), Nmap, and common exploitation frameworks
• Experience writing scripts or automations in Python or Go to support testing workflows
• Ability to clearly document findings with actionable remediation guidance for engineering teams
• Experience partnering with engineering teams to validate and remediate vulnerabilities
• Experience testing mobile applications, hardware/embedded systems, or third-party/vendor platforms
• Familiarity with PCI-related penetration testing requirements and compliance contexts
• Experience contributing to or supporting bug bounty programs (triage, validation, escalation)
• Exposure to threat modeling and ability to identify risk areas pre-deployment

Requirements:

• 7+ years of hands-on penetration testing experience, focused on web applications and APIs in large enterprise environments
• Demonstrated experience executing end-to-end penetration tests (scoping, exploitation, validation, reporting)
• Strong working knowledge of web application vulnerabilities (e.g., OWASP Top 10, authentication/authorization flaws, injection attacks)
• Proficiency with core security testing tools, including Burp Suite (advanced usage required), Nmap, and common exploitation frameworks
• Experience writing scripts or automations in Python or Go to support testing workflows
• Ability to clearly document findings with actionable remediation guidance for engineering teams
• Experience partnering with engineering teams to validate and remediate vulnerabilities
• Experience testing mobile applications, hardware/embedded systems, or third-party/vendor platforms
• Familiarity with PCI-related penetration testing requirements and compliance contexts
• Experience contributing to or supporting bug bounty programs (triage, validation, escalation)
• Exposure to threat modeling and ability to identify risk areas pre-deployment
• Relevant certifications such as OSCP, OSCE, OSWE, or CISSP