Web Application Penetration Tester
First seen by Alion on Nov 13, 2026.
Web Application Penetration Tester (Full-Time or Contract)
Interactivity builds, hosts and maintains websites and apps for international clients.
We are looking for an experienced Web Application Penetration Tester to help identify security vulnerabilities and improve the security of our clients’ websites, web applications, and APIs.
You will work closely with our development and server administration teams to identify security risks, provide clear recommendations, and verify that vulnerabilities have been properly addressed.
What You’ll Do
Conduct authorized penetration tests of client websites, web applications, and APIs.
Identify OWASP Top 10 vulnerabilities, including authentication and session management issues, access control flaws, injection vulnerabilities, and security misconfigurations.
Test CMS platforms and custom applications, including WordPress, Drupal, Joomla, and Symfony.
Review server configurations, TLS, DNS, and email authentication.
Prepare clear security reports with severity ratings, reproduction steps, and actionable remediation recommendations for both technical teams and non-technical clients.
Perform follow-up testing to verify that identified vulnerabilities have been resolved.
Collaborate with developers and server administrators on security improvements.
Agree on testing scope, rules of engagement, and schedules before each assessment.
What We’re Looking For
3+ years of hands-on experience in web application penetration testing.
Strong manual penetration testing skills, including experience with Burp Suite and the ability to identify vulnerabilities that automated scanners may miss.
Ability to use modern AI-powered security testing tools and approaches such as DAST, XBOW, Aikido, and Claude Fable.
Working knowledge of the OWASP Web Security Testing Guide and PHP-based technology stacks.
Strong written communication skills, with the ability to explain technical findings clearly.
Experience working under written authorization and NDAs, with careful handling of confidential client data.
Nice to Have
Relevant certifications, such as CREST, OSCP, GWAPT, OSWE or Burp Suite Certified Practitioner.
Scripting skills in Python or Bash.
Experience with Linux server hardening.
Familiarity with PCI DSS or SOC 2 testing requirements.
Why Interactivity?
Established in 2003, we offer competitive salaries based on experience and productivity; a positive and inclusive work environment;
an opportunity to work with a veteran team on important world-class projects; a benefits package that includes:
✔ Work from anywhere in Ukraine or Europe
✔ Flexible work schedules
✔ VIP health insurance or reimbursement
✔ 20 paid days off
✔ Company-provided laptop and monitor
✔ Free membership at a gym of your choice
How to Apply?
Please send your CV.
If possible, include an anonymized sample penetration testing report from your previous work, ensuring that no confidential client information is disclosed.