[Remote] Security Consultant - Penetration Testing & DevSecOps

Note: The job is a remote job and is open to candidates in USA. Capgemini is a global business and technology transformation partner helping organizations accelerate digital and sustainable transformation. The company is seeking a Senior Security Consultant to conduct penetration testing and security assessments across applications, APIs, cloud environments, and CI/CD pipelines. The role also involves integrating security into the software development lifecycle, managing vulnerabilities, developing security controls, and communicating risks to technical and business stakeholders.

Responsibilities

• Perform manual and automated penetration testing of web applications, APIs, mobile applications, cloud environments, and supporting infrastructure
• Conduct reconnaissance, vulnerability discovery, exploitation, and post-exploitation activities following industry-standard methodologies such as OWASP, PTES, NIST, and MITRE ATT&CK
• Identify security vulnerabilities, validate exploitability, assess business risk, and provide actionable remediation recommendations
• Execute security assessments against modern architectures including microservices, containers, Kubernetes, and cloud-native applications
• Develop proof-of-concepts to demonstrate security weaknesses and attack paths
• Prepare detailed technical reports and executive summaries for customers and stakeholders
• Integrate security controls and testing into CI/CD pipelines
• Implement and manage SAST, DAST, SCA, IaC, Container Security, Secrets Detection, and API Security testing solutions
• Collaborate with development teams to remediate vulnerabilities and adopt secure coding practices
• Participate in security architecture reviews, threat modeling exercises, and secure design assessments
• Automate security testing and compliance validation within DevOps toolchains
• Develop security guardrails and policy-as-code capabilities to improve software security posture
• Perform vulnerability triage, risk prioritization, and remediation tracking
• Support continuous security monitoring and risk assessment activities
• Analyze emerging threats, attack techniques, and security trends to improve testing methodologies
• Assist in development of security standards, procedures, and best practices
• Work with engineering, cloud, and infrastructure teams to enhance organizational security posture
• Present findings and recommendations to developers, architects, engineering teams, and leadership
• Provide security consulting throughout the software development lifecycle

Skills

• This is a remote role based in the US
• We are seeking a Senior Security Consultant - Penetration Testing & DevSecOps with 5-8 years of cybersecurity experience and strong expertise in application penetration testing, offensive security, DevSecOps, SSDLC, and vulnerability management
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field
• 5-8 years of hands-on cybersecurity experience
• Minimum 3+ years of experience conducting application and API penetration testing
• Experience implementing or supporting DevSecOps initiatives within CI/CD environments
• Strong understanding of:
• Web Application Security
• API Security
• Secure SDLC
• OWASP Top 10
• OWASP API Top 10
• MITRE ATT&CK
• Threat Modeling
• Vulnerability Management
• Hands-on experience with:
• Burp Suite Professional
• Nmap
• Nessus / Qualys / Tenable
• Metasploit
• Kali Linux
• Checkmarx
• Veracode
• Snyk
• SonarQube
• GitHub Actions / Azure DevOps / Jenkins
• One or more of the following certifications:
• CRTO
• PNPT
• CEH
• GWAPT
• GPEN
• CISSP
• CCSP
• Azure Security Engineer Associate
• AWS Security Specialty
• Experience with container security (Docker, Kubernetes)
• Experience conducting cloud penetration testing
• Understanding of Infrastructure as Code (Terraform, CloudFormation)
• Familiarity with Red Team methodologies and adversary simulation
• Exposure to Zero Trust Architecture and Secure-by-Design principles
• Excellent communication, consulting, and stakeholder management skills
• OSCP (Preferred)
• Experience with AI/LLM security testing is a plus

Benefits

• This is a remote role based in the US.
• Paid time off based on employee grade (A-F), defined by policy: Vacation: 12-25 days, depending on grade, Company paid holidays, Personal Days, Sick Leave
• Medical, dental, and vision coverage (or provincial healthcare coordination in Canada)
• Retirement savings plans (e.g., 401(k) in the U.S., RRSP in Canada)
• Life and disability insurance
• Employee assistance programs
• Other benefits as provided by local policy and eligibility

Company Overview

Company H1B Sponsorship