Sr. Application Security Engineer / Ethical Hacker
Sherwin-Williams2 days ago
Cleveland, OH, USASenior
Responsibilities
- Plan application security assessments and develop testing strategies based on application functionality, architecture, data flows, and risks.
- Execute manual penetration tests of traditional and AI-enabled applications end-to-end.
- Identify, exploit, validate, document, and retest application security vulnerabilities.
- Evaluate attack paths and application-specific risks that automated testing may miss.
- Develop and maintain scripts, automation, custom tools, testing environments, payloads, and repeatable testing procedures.
- Communicate findings, risk, and remediation recommendations to stakeholders.
- Track assessment status, testing coverage, findings, and remediation progress.
- Create and maintain penetration testing documentation, methodologies, runbooks, and standard operating procedures.
- Mentor and provide technical guidance to less-experienced Application Security team members.
- Support Security Champions and secure development and AI security practices.
- Evaluate security tools, technologies, techniques, and service providers.
- Perform project and task tracking and reporting as needed.
Requirements
- Bachelor’s degree or foreign equivalent, or at least 12 years of Information Technology or Business experience in lieu of a degree.
- At least 5 years of IT and/or cybersecurity experience.
- At least 5 years of application security experience, including hands-on application penetration testing or offensive security assessments.
- Advanced knowledge of web applications, APIs, application security vulnerabilities, manual penetration testing, authentication, authorization, session management, application business logic, SDLC, secure development, AI architecture, and model training processes.
- Experience planning and conducting end-to-end penetration tests, including cloud-native and modern application architectures.
- Experience identifying, exploiting, validating, and documenting vulnerabilities.
- Experience developing scripts, automation, or custom tools using one or more languages.
- Experience using application security and offensive security testing tools.
- Experience communicating technical findings and remediation recommendations to technical and non-technical stakeholders.
- Experience working independently and collaboratively with development, security, and other teams.
- Experience mentoring less-experienced professionals and conducting threat modeling and complex attack-path evaluations.
- Legal authorization to work in the United States without company sponsorship and minimum age of eighteen.
- OSCP certification is strongly preferred.
- Preferred experience includes testing AI-enabled applications, LLMs or related technologies, mobile applications, and legacy industrial systems; reviewing source code; developing proof-of-concept exploits; modifying security testing tools; and holding additional offensive or application security certifications.
Benefits
- Remote position.
- The role is not eligible for work-authorization sponsorship now or in the future.
Categories
About Sherwin-Williams
Sherwin-Williams manufactures and sells paints, coatings, and related products for homeowners, professional contractors, and industrial/OEM customers. It goes to market through company-owned retail stores, commercial sales and distribution, and specialty brands serving architectural, automotive refinish, and industrial and marine applications. Founded in 1866 and headquartered in Cleveland, Ohio, Sherwin-Williams is a public company listed on the NYSE.