Senior Information Security Analyst – Penetration Tester

Senior Information Security Analyst – Penetration Tester

Location: San Antonio, TX- *On-Site Required* (1-2 days remote 1n San Antonio)
Contract Length: 12 months
Position Type: Contract
Rate: $65-$67/Hr.  (W2 Only) 

Job Summary

We are seeking an experienced Senior Information Security Analyst – Penetration Tester to support the  Information Security team in automating and scaling its Bug Bounty program. The ideal candidate will have strong hands-on experience in web application and infrastructure penetration testing, vulnerability assessment, security finding validation, and remediation support.

In this role, the selected candidate will evaluate and validate reported security vulnerabilities, triage and prioritize findings based on risk, and integrate confirmed issues into the enterprise ticketing system. The candidate will also contribute to developing scalable processes that leverage scripting, automation, APIs, and AI-assisted tools to improve vulnerability validation and prioritization.

The successful candidate will work closely with developers and security stakeholders to improve application security, reduce false positives, eliminate duplicate findings, and accelerate vulnerability remediation.

Key Responsibilities

• Perform web application and infrastructure penetration testing to identify security vulnerabilities and potential attack vectors.
• Review, validate, reproduce, and triage Bug Bounty submissions to determine their legitimacy, severity, and potential business impact.
• Identify false positives, duplicate findings, and incomplete or inaccurate vulnerability reports.
• Assess and prioritize security findings using industry-standard risk assessment methodologies, including CVSS, DREAD, or similar frameworks.
• Document confirmed vulnerabilities and create or update tickets in enterprise vulnerability management and ticketing platforms.
• Collaborate with software developers and security teams to support vulnerability remediation and provide secure coding recommendations.
• Develop and improve workflows for vulnerability validation, triage, prioritization, and reporting.
• Leverage scripting, automation, APIs, and AI-assisted tools to improve the efficiency and scalability of security operations.
• Contribute to the development of AI-driven processes for validating and prioritizing security findings.
• Maintain clear technical documentation of findings, risk assessments, remediation recommendations, and testing results.
• Support continuous improvement of the Bug Bounty program and associated vulnerability management processes.

Required Qualifications

• Demonstrated experience in web application and infrastructure penetration testing.
• Hands-on experience validating, reproducing, and triaging security vulnerabilities and Bug Bounty submissions.
• Strong understanding of vulnerability assessment, risk analysis, and severity classification using CVSS, DREAD, or comparable methodologies.
• Experience working with developers to remediate vulnerabilities and provide practical secure coding guidance.
• Familiarity with vulnerability management and enterprise ticketing platforms, such as ServiceNow, Jira, Azure DevOps, or similar tools.
• Experience using scripting languages, automation frameworks, APIs, or AI-assisted workflows to streamline security testing and analysis.
• Strong analytical, troubleshooting, documentation, and communication skills.
• Ability to communicate technical vulnerabilities and risk implications clearly to technical stakeholders.

Preferred Qualifications

• Industry-recognized penetration testing or security certifications, such as:
  • GIAC Penetration Tester (GPEN)
  • Offensive Security Certified Professional (OSCP)
  • CompTIA PenTest+
  • Other equivalent industry-recognized certifications
• Experience supporting or scaling Bug Bounty programs.
• Familiarity with large-scale vulnerability management processes and automated security finding ingestion.
• Experience with Python, PowerShell, or similar scripting languages.
• Exposure to large language models (LLMs) and AI-assisted security validation, analysis, and prioritization workflows.

Ideal Candidate Profile

The ideal candidate is a hands-on penetration tester who combines technical security expertise with automation and vulnerability management experience. This individual should be comfortable evaluating security findings, distinguishing actionable vulnerabilities from false positives, working collaboratively with developers, and building repeatable processes that improve the effectiveness of an enterprise security program.

Interested candidates should have a strong background in penetration testing, vulnerability triage, remediation collaboration, and security automation.