{"id":129217,"url":"https://alion.io/job/chubb-senior-application-penetration-tester","title":"Senior Application Penetration Tester","company":{"id":18935,"name":"Chubb","domain":"chubb.com","url":"https://alion.io/company/chubb","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":84,"open_postings":94,"ghost_share":0,"stale_share":0.84,"repost_share":0,"time_to_fill_p50_days":9,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Philadelphia, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":109000,"max_usd":211000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"GraphQL","optional":false},{"name":"gRPC","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"AI Agents","optional":true},{"name":"AutoGen","optional":true},{"name":"Burp Suite","optional":true},{"name":"Checkmarx","optional":true},{"name":"Grype","optional":true},{"name":"Insomnia","optional":true},{"name":"Kali Linux","optional":true},{"name":"LangChain","optional":true},{"name":"Linux","optional":true},{"name":"Metasploit","optional":true},{"name":"Nmap","optional":true},{"name":"OWASP ASVS","optional":true},{"name":"OWASP ZAP","optional":true},{"name":"Postman","optional":true},{"name":"Prowler","optional":true},{"name":"RAG","optional":true},{"name":"ScoutSuite","optional":true},{"name":"Semantic Kernel","optional":true},{"name":"Semgrep","optional":true},{"name":"Snyk","optional":true},{"name":"SQLmap","optional":true},{"name":"Trivy","optional":true},{"name":"Veracode","optional":true}],"status":"live","first_seen_at":"2026-08-24T00:00:00Z","employer_posted_date":"2026-08-24","last_verified_at":"2026-10-19T13:28:11Z","board_verified":true,"closed_at":null,"days_open":56,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":56},"description":"Plan and execute penetration tests across web, mobile (iOS & Android), API, cloud-native/containerized, and AI/LLM-integrated applications\nAssess AI/ML and generative AI-powered features for risks such as prompt injection, insecure output handling, training data poisoning, model denial of service, and sensitive information disclosure, aligned to the OWASP Top 10 for LLM Applications and MITRE ATLAS\nPartner with AI/ML engineering and data science teams to threat-model AI-powered features and embed security testing into MLOps and CI/CD pipelines\nEvaluate cloud-native and containerized workloads (AWS, Azure, GCP, Docker, Kubernetes) and Infrastructure as Code for misconfigurations and weak security controls\nTest modern API architectures (REST, GraphQL, gRPC), including OAuth2, OIDC, and JWT authentication and authorization flaws, and microservices-based applications\nConduct mobile application security testing and reverse engineering, including hardcoded credentials, insecure keychain storage, and anti-emulator/obfuscation bypass\nOwn the overall vulnerability remediation status of the global application portfolio, and serve as the primary point of contact for application teams on remediation matters\nManage application risk rating processes and ensure timely risk scoring of new and changing applications\nBuild and maintain dashboards and status reports for portfolio leads and CIOs, and follow up on overdue vulnerabilities to meet compliance timelines\nDevelop clear, actionable penetration test reports and communicate findings and remediation strategy to both technical and executive stakeholders\nResearch emerging attack techniques and tooling, and drive automation and process improvements across the testing program\n Minimum:\nPrior experience managing Information Security projects\nBachelor's Degree in Computer Science, Engineering, or other Engineering or Technical discipline, or equivalent relevant experience\nMinimum of 2 years' professional experience performing web application, API endpoint, and mobile (iOS & Android) penetration testing\nKnowledge of prioritizing remediation activities with operational teams through risk ratings of vulnerabilities and assets\nKnowledge of industry standards regarding vulnerability management, including Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS)\nKnowledge of technology and security topics including network security, wireless security, application security, infrastructure hardening and security baselines, and web server and database security\nKnowledge of penetration testing principles, tools, and techniques\nWorking experience with industry frameworks (OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, NIST, NIST AI Risk Management Framework, MITRE ATT&CK, etc.)\nComfortable working outside their comfort zone with a willingness to learn\nExcellent verbal and written communication skills\nStrong analytical skills\nStrong team player with the ability to work independently\nStrong project management skills and ability to multi-task\nSelf-motivated with strong initiative\nKnowledge of computer networking concepts and protocols, and application security methodologies\nSkill in performing impact/risk assessments\nFamiliarity with modern application architectures, including cloud-native (AWS, Azure, GCP), containerized (Docker, Kubernetes), microservices, and API-first (REST, GraphQL, gRPC) designs\nFoundational understanding of AI/ML and generative AI security risks (e.g., prompt injection, model manipulation, sensitive data leakage) is a plus\nNice To Have:\nStrong understanding of secure SDLC, exploit/attack techniques, and core networking, application, and OS concepts, with the ability to manipulate application logic, bypass security controls, and develop exploits\nExperience scoping and leading engagements end-to-end - from kickoff through remediation tracking - and improving testing efficiency through automation, tooling, and process improvements\nProficient with industry-standard tools across categories: Kali Linux, Metasploit, Nmap, Burp Suite/OWASP ZAP (web); Santoku, Genymotion, APKTool, JD-GUI (mobile); SQLMap, Semgrep, Snyk, Checkmarx/AppScan/Veracode (code); Postman/Insomnia (API); Trivy/Grype, Prowler/ScoutSuite (cloud & containers); and Garak/PyRIT (AI red-teaming)\nSkilled in identifying OWASP Top 10 (Web & Mobile), OWASP API Security Top 10, and OWASP LLM Top 10 vulnerabilities, and developing secure coding checklists based on OWASP ASVS\nExperience conducting full-scope assessments and penetration tests - web, mobile, API, social engineering, and server/client-side attacks - including mobile reverse engineering (hardcoded credentials, SQLi, keychain exposure, anti-emulator/obfuscation bypass)\nExperience assessing cloud-native and containerized applications (AWS, Azure, GCP, Docker, Kubernetes), modern CI/CD pipelines and Infrastructure as Code, and modern API architectures (REST, GraphQL, gRPC) including OAuth2/OIDC/JWT flaws\nExperience or working knowledge testing AI/ML and generative AI features for risks such as prompt injection, insecure output handling, training data poisoning, and sensitive data disclosure, aligned to the OWASP LLM Top 10 and MITRE ATLAS, plus working knowledge of securing AI agent/orchestration frameworks (LangChain, Semantic Kernel, AutoGen) and RAG vector databases\nSkilled in code analysis, exploit development, and using attacker tools/tactics/procedures to identify, validate, and demonstrate vulnerabilities an adversary could exploit\nAbility to analyze findings (including root cause analysis), risk-rate vulnerabilities by actual business impact, and prioritize key risk areas\nAbility to document findings clearly, including reproduction steps, and produce comprehensive, accurate penetration test reports\nAbility to research and recommend practical short- and long-term remediations, and communicate findings and strategy effectively to both technical and executive stakeholders\nExperience working closely with development teams to track remediation through to production deployment, maintain vulnerability status dashboards, and follow up on overdue items to meet compliance timelines\nPreferred certifications: OSCP, OSWE, GWAPT, GPEN, CEH, GCPN, CCSP, or equivalent AI/ML security credentials\nStrong communicator and collaborative team player, able to adapt and reprioritize as project needs shift","description_format":"text","description_chars":6437,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Property & Casualty Insurance","Reinsurance"],"lifecycle":[{"event":"open","at":"2026-08-24T00:00:00Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-17T06:21:15+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.219,"p_room":0.28,"age_days":56,"expected_fill_days":9,"reasons":["conf:10","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/chubb-senior-application-penetration-tester","json_url":"https://alion.io/job/chubb-senior-application-penetration-tester.json","meta":{"generated_at":"2026-10-19T17:30:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13275,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18935},"rest":"https://alion.io/mcp/rest/get_company?id=18935"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fchubb-senior-application-penetration-tester"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fchubb-senior-application-penetration-tester"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fchubb-senior-application-penetration-tester"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/chubb-senior-application-penetration-tester\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fchubb-senior-application-penetration-tester"}]}