Schedule a call →

<p>Interview fractional leaders this week for <strong>free</strong>!</p>

Bishop Fox offensive security services help you find and fix vulnerabilities before they become incidents. We simulate real-world attacks across your…

Bishop Fox Icon

Bishop Fox is a pioneering brand in offensive security, offering a comprehensive range of products and services to protect organizations from cyber threats. With nearly two decades of experience, they are renowned for their continuous pen testing, red teaming, attack surface management, and traditional security assessments. Their innovative Cosmos platform, winner of SC Media's Best Emerging Technology Award, provides continuous testing and attack surface management to enable proactive defense. Bishop Fox's extensive portfolio includes application security, red team and readiness assessments, IoT and product security validation, cloud security assessments, network security analysis, and compliance services. Trusted by industry titans such as Fortune 100 companies, global media, retailers, and tech giants, Bishop Fox has completed over 16,000 projects in the last three years alone. Their mission to proactively prevent breaches drives them to stay ahead of emerging threats by investing in research and providing top-tier offensive security solutions. Stay secure with Bishop Fox and experience the difference in proactive defense.

Bishop Fox

Bishop Fox Logo

At Bishop Fox, security isn't just a job—it's our passion. As leaders in continuous offensive security and penetration testing, we deliver world-class customer experiences. Trusted by over a quarter of the Fortune 100, half of the Fortune 10, and top global media companies, we help safeguard digital landscapes. Our Cosmos platform, honored as Best Emerging Technology by SC Media, exemplifies our commitment to innovation.

Joining Bishop Fox means collaborating with a curious and dedicated team. You'll tackle complex challenges for some of the world's most recognized organizations, securing their networks against real-world threats. With nearly 20 years of industry contributions—including 16 open-source tools and 50 security advisories published in the past five years—we're committed to making the digital world safer.

## Penetration Tester - Contract

**Location:** U.S. Remote

**Position Type:** Contract (1099 Independent Contractor)

### Overview

Bishop Fox is looking for experienced contract penetration testers with a primary focus in web application security and strong secondary expertise in cloud, mobile, source code, network, or AI/LLM security. You'll work on a range of projects, from short-term assessments to longer-term program engagements with well-established clients.

### Responsibilities

- Identify vulnerabilities, validate risk, develop creative solutions, and clearly communicate findings and remediation guidance to both technical and executive stakeholders
- Plan, conduct, and manage web application penetration tests
- Assess vulnerabilities and develop exploits across diverse targets
- Serve as a trusted advisor to help clients understand risk and make informed security decisions
- Work alongside US and internationally-based teams supporting clients across multiple industries

### Required Experience

- 5+ years of experience planning, conducting, and managing web application penetration tests
- Deep understanding of application security fundamentals, OWASP Top 10, common vulnerabilities, and secure development best practices
- Experience assessing vulnerabilities and developing exploits across diverse targets
- Strong understanding of system and network security, authentication protocols, security protocols, and applied cryptography
- Ability to communicate complex technical findings clearly and provide practical remediation guidance to technical and executive audiences

### Preferred Experience

Deep experience in at least one of the following:

- **Cloud Security** - Experience assessing AWS cloud environments, including technologies such as IAM, EC2, VPC, EBS, S3, CloudWatch, and Lambda
- **Mobile Application Security** - Experience testing iOS and/or Android applications, including mobile application architecture, API communication, data storage, authentication flows, and common mobile security vulnerabilities
- **Source Assisted Application Assessments** - Experience evaluating applications across multiple layers, including source code, APIs, infrastructure, and integrations. Strong proficiency in Golang is highly preferred, along with familiarity in languages such as Python, Ruby, PowerShell, Java, and JavaScript
- **Network Security** - Experience with network and system exploitation, including modern tactics, techniques, and procedures such as C2 frameworks, EDR bypass, privilege escalation, password cracking, and lateral movement
- **AI/LLM Security** - Experience assessing non-deterministic security controls

### Employment Details

- **Employment Type:** Independent contractor (1099)
- **Sponsorship:** Not eligible for any form of employment sponsorship. Applicants must be legally authorized to work in the United States without requiring visa sponsorship now or in the future
- **Location Requirement:** Must be located in the United States
- **Background Check:** All new hires must pass a background check as a condition of employment

10 Years People Experience | Recruiting Leader | Mission Driven | Scaling World-Class Engineering & Security Teams

Kaitlin O'Neil

Head of Talent Acquisition

Talent Acquisition Specialist and Staffing Consultant

Areli Ch Duran

Senior Technical Recruiter

Job Listing | Bishop Fox

Network Security

Application Security

Cloud Security

OWASP

Bishop Fox is recognized as the leading authority in offensive security, providing solutions ranging from continuous penetration testing, red teaming, and attack surface management to product, cloud, and application security assessments.

Enterprises have been told that breaches are inevitable. But we don’t accept that. We focus on offensive security because we believe securing modern organizations requires a "forward defense" approach that proactively uncovers and eliminates exposures before they are exploited.

Over the past 20 years, we’ve worked with more than 25% of the Fortune 100, 8 of the top 10 global tech companies, and hundreds of other organizations to improve their security.

Security isn’t just a job to us. We do this because we love it — and because we're committed to the common good. In fact, we have authored 20+ open-source tools, shared groundbreaking research, and published more than 50 security advisories in the last 5 years. Learn more about us at bishopfox.com or follow us on X @bishopfox for the latest updates.

Bishop Fox, the leader in offensive security, continuous pen testing, red teaming, attack surface management, and traditional security assessments.

**Contract Penetration Tester**

At Bishop Fox, security isn't just a job—it's our passion. As leaders in continuous offensive security and penetration testing, we deliver world-class customer experiences. Trusted by over a quarter of the Fortune 100, half of the Fortune 10, and top global media companies, we help safeguard digital landscapes. Our Cosmos platform, honored as Best Emerging Technology by SC Media, exemplifies our commitment to innovation.

Joining Bishop Fox means collaborating with a curious and dedicated team. You'll tackle complex challenges for some of the world's most recognized organizations, securing their networks against real-world threats. With nearly 20 years of industry contributions—including 16 open-source tools and 50 security advisories published in the past five years—we're committed to making the digital world safer.

We're looking for talented, experienced professional hackers to help us secure some of the world's most complex software and sophisticated technologies. You'll be working alongside our US and internationally-based teams supporting clients across multiple industries.

**Responsibilities**

Bishop Fox is looking for experienced contract penetration testers with a primary focus in web application security and strong secondary expertise in cloud, mobile, source code, network, or AI/LLM security.

You'll work on a range of projects, from short-term assessments to longer-term program engagements with well-established clients. In this role, you'll identify vulnerabilities, validate risk, develop creative solutions, and clearly communicate findings and remediation guidance to both technical and executive stakeholders. As a trusted advisor, you'll help clients understand risk and make informed security decisions.

**Experience**

- 5+ years of experience planning, conducting, and managing web application penetration tests
- Deep understanding of application security fundamentals, OWASP Top 10, common vulnerabilities, and secure development best practices
- Experience assessing vulnerabilities and developing exploits across diverse targets
- Strong understanding of system and network security, authentication protocols, security protocols, and applied cryptography
- Ability to communicate complex technical findings clearly and provide practical remediation guidance to technical and executive audiences

**Preferred Experience**

Deep experience in at least one of the following:

- **Cloud Security** - Experience assessing AWS cloud environments, including technologies such as IAM, EC2, VPC, EBS, S3, CloudWatch, and Lambda.

- **Mobile Application Security** - Experience testing iOS and/or Android applications, including mobile application architecture, API communication, data storage, authentication flows, and common mobile security vulnerabilities.

- **Source Assisted** **Application Assessments:** Experience evaluating applications across multiple layers, including source code, APIs, infrastructure, and integrations. Strong proficiency in Golang is highly preferred, along with familiarity in languages such as Python, Ruby, PowerShell, Java, and JavaScript.

- **Network Security** - Experience with network and system exploitation, including modern tactics, techniques, and procedures such as C2 frameworks, EDR bypass, privilege escalation, password cracking, and lateral movement.

- **AI/LLM Security** -Experience assessing non-deterministic security controls.

**Employment Sponsorship**

This engagement is for independent contractors (1099) and **is not eligible for any form of employment sponsorship.** Applicants must be legally authorized to work in the United States without requiring visa sponsorship now or in the future. Applicants must be located in the United States.

All new hires must pass a background check as a condition of employment.

*Bishop Fox is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.*

Penetration Tester - Contract

United States

Bishop Fox is seeking experienced contract penetration testers with expertise in web application security and secondary skills in cloud, mobile, source code, network, or AI/LLM security. This remote role involves identifying vulnerabilities, validating risks, and providing remediation guidance to clients.

Bishop Fox

About Bishop Fox

Jobs

Fractional Penetration Tester

About this page