Cyber - AppSec - Web PT Consultant - KPMG International

*Description for Internal Candidates    
Roles and Responsibilities:
•   Perform manual Application penetration testing against API’s (REST/SOAP), Web Applications, Mobile applications, and thick client applications
•   Perform threat modeling, evaluate application business logic, and perform application architecture reviews
•   Ability to demonstrate application testing experience in real time via demos to both internal and external audiences
•   Act independently in penetration testing engagements, with minimal oversight and guidance
•   Act as a technical leader and mentor for junior engineers
•   Engage with technical and non-technical audiences to articulate both testing processes, techniques and results; guide technical audiences on remediation options and assist clients in weighing those options
•   Partner with the Cyber teams to develop new testing techniques, automation for testing and marketing collateral to support the practice and mentor junior and offshore team members on tools and techniques in performing tests
Qualifications:
•   Minimum three years of recent experience in application penetration testing of API’s, web applications, or mobile applications
•   Ability to communicate reporting results with technical and non-technical audiences and lead remediation conversations
•   Experience with burp suite pro, and other app testing tools such as Netsparker and Checkmarx
•   Bachelors degree from an accredited college/university or equivalent industry experience
•   One or more major ethical hacking certifications not required but preferred; GWAPT, CREST, OSWE, OSWA

*Description for Internal Candidates    
Roles and Responsibilities:
•   Perform manual Application penetration testing against API’s (REST/SOAP), Web Applications, Mobile applications, and thick client applications
•   Perform threat modeling, evaluate application business logic, and perform application architecture reviews
•   Ability to demonstrate application testing experience in real time via demos to both internal and external audiences
•   Act independently in penetration testing engagements, with minimal oversight and guidance
•   Act as a technical leader and mentor for junior engineers
•   Engage with technical and non-technical audiences to articulate both testing processes, techniques and results; guide technical audiences on remediation options and assist clients in weighing those options
•   Partner with the Cyber teams to develop new testing techniques, automation for testing and marketing collateral to support the practice and mentor junior and offshore team members on tools and techniques in performing tests
Qualifications:
•   Minimum three years of recent experience in application penetration testing of API’s, web applications, or mobile applications
•   Ability to communicate reporting results with technical and non-technical audiences and lead remediation conversations
•   Experience with burp suite pro, and other app testing tools such as Netsparker and Checkmarx
•   Bachelors degree from an accredited college/university or equivalent industry experience
•   One or more major ethical hacking certifications not required but preferred; GWAPT, CREST, OSWE, OSWA

Prior Experience:

The candidate must have 3 to 5 years of relevant experience in a similar role, preferably in a professional services organization.