Consulting - RAS Security, Privacy and Risk Web Application Pen Tester

Apply Now >>    

In order to address the most critical needs of our clients, RSM US LLP has established the Security and Privacy Services group, comprised of more than 100 professionals dedicated exclusively to serving the cyber security needs of our clients. This group includes experienced consultants located throughout the country dedicated to helping clients with preventing, detecting, and responding to security threats that may affect their critical systems and data. We serve a diverse client base within a variety of industries, and we are relied upon to provide expertise within areas of security testing, architecture, governance, compliance, and digital forensics.


We are seeking individuals skilled at performing vulnerability assessments, penetration testing, secure code reviews, and secure architecture reviews of web applications and their related infrastructure.


Responsibilities will be based on background but will typically include:

  • Perform analysis and testing to verify the strengths and weaknesses of Web Applications and Web Services (SML, SOAP, WSDL, UDDI, etc.) utilizing commercial and open source security testing tools

  • Perform Internet penetration testing (blackbox/greybox /whitebox testing) and code reviews (manual/automated) of web applications and related infrastructure

  • Perform automated and manual reviews of the underlying code of web applications in regards to common security weaknesses

  • Assist with the development of remediation recommendations for identified findings

  • Identify and clearly articulate (written and verbal) findings to senior management and clients. Help identify improvement opportunities for assigned clients Supervise and provide engagement management for other staff working on assigned engagements 

Basic Qualifications:

  • This position is for individuals with 1-6 years of experience within the cyber security space, with a preference for prior consulting or professional services backgrounds.  Other candidates may be considered based on experience and skill sets.

  • Ability to travel as needed

  • Must possess a high degree of integrity and confidentiality, as well as the ability to adhere to both company policies and best practices

  • Strong verbal and written abilities

  • Strong multitasking and project management skills

Preferred Qualifications:

  • Bachelor’s degree in computer science or related field from an accredited college/university

  • Technical background in web application development, architecture, assessment or related fields

  • Experience with testing and development frameworks such as the Open Web Application Security Project (OWASP), Open Source Security Testing Methodology Manual (OSSTMM), the Penetration Testing Execution Standard (PTES)Operating System Configuration and Security experience (Windows, HP-UX, Linux, Solaris, AIX, etc.)

  • Configuration and Security experience with Web Servers and Web Applications (Apache HTTP/Tomcat, Microsoft IIS, Sun One, Oracle iPlanet, IBM WebSphere, etc.)

  • Database Configuration and Security experience (MySQL, Microsoft SQL, IBM DB2, Sybase, Oracle, etc.)Web Service experience (XML, SOAP, WSDL, UDDI, etc.)

  • Experience with discovering and demonstrating web application vulnerabilities such as Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Injection Flaws, Remote file inclusion (RFI) and SQL InjectionCommercial Application Security tools experience (AppScan, WebInspect, Acunetix, etc.)

  • Web Proxy tools experience (Achilles, Webscarab, Burp, Spike, Paros, etc.)

  • One or more of the following technical certifications: Sun Certified Java Developer® (SCJD®); Microsoft Certified Solution Developer® (MCSD®) for .NET; Certified Ethical Hacker (CEH); GIAC Certified Penetration Tester (GPEN); Offensive Security Certified Professional (OSCP); GIAC Web Application Security (GWAS);or equivalent development or testing certification (ECSA, CEPT, CPTE, CPTS, etc.)

  • In addition, one or more of the following governance certifications is preferred: Certified Information Systems Security Professionals® (CISSP®); Certified Information Systems Auditor® (CISA®); Certified Information Security Manager® (CISM®) 

You want your next step to be the right one. You've worked hard to get where you are today. And now you're ready to use your unique skills, talents and personality to achieve great things. RSM is a place where you are valued as an individual, mentored as a future leader, and recognized for your accomplishments and potential. Working directly with clients, key decision makers and business owners across various industries and geographies, you'll move quickly along the learning curve and our clients will benefit from your fresh perspective.

Experience RSM US. Experience the power of being understood.

RSM is an equal opportunity/affirmative action employer. Minorities/Females/Disabled/Veterans.
Job ID req3478_Cedar Rapids
Line of Business: Consulting Services
SubFunction: RAS Security, Privacy & Risk
Job Type: Full Time
Req #: req3478_Cedar Rapids
Location: 201 1st St SE, , Cedar Rapids, IA US
Region: Southeast Region
Job Category: Business Consulting/Technology
Employment Type: Experienced
Degree Required: Bachelor
Travel: Yes
Apply Now >>