About the role
As a Senior Application Security Pentester, you will play a key role in strengthening our security posture by ensuring efficient security audits during the release process. Your expertise and proactive approach will help maintain the speed and quality of our software releases by identifying and mitigating vulnerabilities before they become critical issues. This role also offers the opportunity to contribute to the development and evolution of the Offensive Security function within the Security Department.
Key Responsibilities
* Lead and conduct in-depth penetration tests on web applications, APIs, and other software components to identify complex security vulnerabilities.
* Analyze findings, prioritize risks, and provide strategic remediation recommendations while working closely with cross-functional teams.
* Develop and refine custom scripts and tools to automate and optimize security testing processes.
* Stay up to date with emerging threats, vulnerabilities, and industry trends to ensure proactive defense measures.
* Contribute to knowledge sharing and continuous improvement through research, training, and participation in internal and external security events (e.g., CTFs, meetups).
* Support the evolution of Offensive Security practices and processes within the Security Department.
About you
Move together. Raise the bar. Learn fast-grow faster. That’s the default. And here’s what else is needed to succeed in this role:
* Deep knowledge of common vulnerabilities and industry standards such as the OWASP Top 10.
* Ability to read and understand code (e.g., Go, Java, Python) to identify security flaws.
* Familiarity with cloud environments and related security considerations.
* Strong analytical and problem-solving skills with attention to detail.
Not required but a plus
* Experience using or building AI-assisted security testing solutions.
* Certifications such as BSCP, OSWE, GWAPT, or similar.
* Experience automating security tests in CI/CD pipelines (GitLab/GitHub CI/CD, YAML).
* Active participation in security communities or conferences.
* Proficiency in scripting languages (e.g., Python, Bash) to automate tasks.
* Published CVEs or bug bounty reports. #LI-Remote
About the perks
* Unlimited PTO
* Hobby & team building budget allowance
* Employee Support Program
* Loss of family member financial aid
* Employee Resource Groups
A little more about us
Semrush (NYSE: SEMR) is the leading brand visibility platform, empowering marketers to command their online presence and create measurable impact. Built on the industry’s most expansive proprietary dataset, Semrush delivers AI-driven insights across GEO, SEO, Agentic Search Optimization, content marketing, paid media, and social strategy. The company was founded in 2008 and is headquartered in Boston, MA with a global presence across North America, Europe and Asia.
We’ve built something people are proud to be part of. And the awards agree: Great Place to Work, DEI Workplace, Diversity Champion Award, International Inclusion Award, Most Women Friendly Employers, Best Place for Working Parents. All thanks to 1700+ employees who build the company every day.
About our Diversity, Equity, and Inclusion commitments
Semrush is an equal opportunity employer. Building a better future for marketers around the world unites people from all backgrounds. Even if you feel that you don’t 100% match all requirements, don’t be discouraged to apply! We are committed to ensure that everyone feels a sense of belonging in the workplace. We do not discriminate based upon race, religion, creed, color, national origin, sex, pregnancy, sexual orientation, gender identity, gender expression, age, ancestry, physical or mental disability, or medical condition including medical characteristics, genetic identity, marital status, military service, or any other classification protected by applicable local, state or federal laws.
Ready to be a part of this mission? Join us!
Apply for this job
#J-18808-Ljbffr