Chubb

Senior Application Penetration Tester

Chubb • $110K — $130K *
Philadelphia, PA 19120In-Person
Information Technology
Less than 5 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • 5-7 years of experience in Information Security management
  • Bachelor's Degree in a relevant technical discipline
  • 2+ years in penetration testing across web, API, and mobile platforms
  • Knowledge of vulnerability management and risk rating
  • Familiarity with industry standards like OWASP and MITRE frameworks
  • Strong analytical and communication skills
  • Proficiency in modern application architectures and security methodologies

Responsibilities

  • Plan and execute penetration tests for web, mobile, API, and cloud-native applications
  • Assess AI-powered features for security risks and compliance
  • Collaborate with engineering teams to integrate security in CI/CD pipelines
  • Evaluate cloud-native workloads for security misconfigurations
  • Conduct mobile application security testing and reverse engineering
  • Manage global application vulnerability remediation processes
  • Develop actionable penetration test reports for various stakeholders

Benefits

  • Professional development opportunities
  • Flexible work arrangements
  • Collaborative team environment
  • Access to cutting-edge security tools and technologies
  • Health and wellness programs
Full Job Description
Job Description

  • Plan and execute penetration tests across web, mobile (iOS & Android), API, cloud-native/containerized, and AI/LLM-integrated applications
  • Assess AI/ML and generative AI-powered features for risks such as prompt injection, insecure output handling, training data poisoning, model denial of service, and sensitive information disclosure, aligned to the OWASP Top 10 for LLM Applications and MITRE ATLAS
  • Partner with AI/ML engineering and data science teams to threat-model AI-powered features and embed security testing into MLOps and CI/CD pipelines
  • Evaluate cloud-native and containerized workloads (AWS, Azure, GCP, Docker, Kubernetes) and Infrastructure as Code for misconfigurations and weak security controls
  • Test modern API architectures (REST, GraphQL, gRPC), including OAuth2, OIDC, and JWT authentication and authorization flaws, and microservices-based applications
  • Conduct mobile application security testing and reverse engineering, including hardcoded credentials, insecure keychain storage, and anti-emulator/obfuscation bypass
  • Own the overall vulnerability remediation status of the global application portfolio, and serve as the primary point of contact for application teams on remediation matters
  • Manage application risk rating processes and ensure timely risk scoring of new and changing applications
  • Build and maintain dashboards and status reports for portfolio leads and CIOs, and follow up on overdue vulnerabilities to meet compliance timelines
  • Develop clear, actionable penetration test reports and communicate findings and remediation strategy to both technical and executive stakeholders
  • Research emerging attack techniques and tooling, and drive automation and process improvements across the testing program


Qualifications

Minimum:
  • Prior experience managing Information Security projects
  • Bachelor's Degree in Computer Science, Engineering, or other Engineering or Technical discipline, or equivalent relevant experience
  • Minimum of 2 years' professional experience performing web application, API endpoint, and mobile (iOS & Android) penetration testing
  • Knowledge of prioritizing remediation activities with operational teams through risk ratings of vulnerabilities and assets
  • Knowledge of industry standards regarding vulnerability management, including Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS)
  • Knowledge of technology and security topics including network security, wireless security, application security, infrastructure hardening and security baselines, and web server and database security
  • Knowledge of penetration testing principles, tools, and techniques
  • Working experience with industry frameworks (OWASP, OWASP API Security Top 10, OWASP Top 10 for Large Language Model (LLM) Applications, NIST, NIST AI Risk Management Framework, MITRE ATT&CK, etc.)
  • Comfortable working outside their comfort zone with a willingness to learn
  • Excellent verbal and written communication skills
  • Strong analytical skills
  • Strong team player with the ability to work independently
  • Strong project management skills and ability to multi-task
  • Self-motivated with strong initiative
  • Knowledge of computer networking concepts and protocols, and application security methodologies
  • Skill in performing impact/risk assessments
  • Familiarity with modern application architectures, including cloud-native (AWS, Azure, GCP), containerized (Docker, Kubernetes), microservices, and API-first (REST, GraphQL, gRPC) designs
  • Foundational understanding of AI/ML and generative AI security risks (e.g., prompt injection, model manipulation, sensitive data leakage) is a plus


Nice To Have:
  • Strong understanding of secure SDLC, exploit/attack techniques, and core networking, application, and OS concepts, with the ability to manipulate application logic, bypass security controls, and develop exploits
  • Experience scoping and leading engagements end-to-end - from kickoff through remediation tracking - and improving testing efficiency through automation, tooling, and process improvements
  • Proficient with industry-standard tools across categories: Kali Linux, Metasploit, Nmap, Burp Suite/OWASP ZAP (web); Santoku, Genymotion, APKTool, JD-GUI (mobile); SQLMap, Semgrep, Snyk, Checkmarx/AppScan/Veracode (code); Postman/Insomnia (API); Trivy/Grype, Prowler/ScoutSuite (cloud & containers); and Garak/PyRIT (AI red-teaming)
  • Skilled in identifying OWASP Top 10 (Web & Mobile), OWASP API Security Top 10, and OWASP LLM Top 10 vulnerabilities, and developing secure coding checklists based on OWASP ASVS
  • Experience conducting full-scope assessments and penetration tests - web, mobile, API, social engineering, and server/client-side attacks - including mobile reverse engineering (hardcoded credentials, SQLi, keychain exposure, anti-emulator/obfuscation bypass)
  • Experience assessing cloud-native and containerized applications (AWS, Azure, GCP, Docker, Kubernetes), modern CI/CD pipelines and Infrastructure as Code, and modern API architectures (REST, GraphQL, gRPC) including OAuth2/OIDC/JWT flaws
  • Experience or working knowledge testing AI/ML and generative AI features for risks such as prompt injection, insecure output handling, training data poisoning, and sensitive data disclosure, aligned to the OWASP LLM Top 10 and MITRE ATLAS, plus working knowledge of securing AI agent/orchestration frameworks (LangChain, Semantic Kernel, AutoGen) and RAG vector databases
  • Skilled in code analysis, exploit development, and using attacker tools/tactics/procedures to identify, validate, and demonstrate vulnerabilities an adversary could exploit
  • Ability to analyze findings (including root cause analysis), risk-rate vulnerabilities by actual business impact, and prioritize key risk areas
  • Ability to document findings clearly, including reproduction steps, and produce comprehensive, accurate penetration test reports
  • Ability to research and recommend practical short- and long-term remediations, and communicate findings and strategy effectively to both technical and executive stakeholders
  • Experience working closely with development teams to track remediation through to production deployment, maintain vulnerability status dashboards, and follow up on overdue items to meet compliance timelines
  • Preferred certifications: OSCP, OSWE, GWAPT, GPEN, CEH, GCPN, CCSP, or equivalent AI/ML security credentials
  • Strong communicator and collaborative team player, able to adapt and reprioritize as project needs shift

About Chubb

Chubb Limited is a Swiss-based global insurance company that provides commercial and personal property and casualty insurance, personal accident and supplemental health insurance (A&H), reinsurance, and life insurance to a diverse group of clients. Chubb operates in 54 countries and territories and is the world's largest publicly traded property and casualty insurance company. The company has a long history, dating back to 1882, and has grown through a series of mergers and acquisitions. Chubb is known for its high-quality insurance products and services, as well as its strong financial performance and commitment to corporate social responsibility.
Learn more about Chubb
Size
31,000 employees
Market Cap
$90.7 billion
Industry
Finance & Insurance
Net Income
$3.5 billion
Founded
1882
5 Year Trend
+5.3%
Revenue
$35.9 billion
NASDAQ
CB
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at Chubb

More Information Technology Jobs

Find similar Senior Application Penetration Tester jobs:

NationwidePhiladelphia, PA