application security engineer vs penetration tester