Penetration Tester — Web & API

Role overview Conduct hands-on security assessments of web applications and APIs for clients in sectors including finance, healthcare and software services. You’ll take tests from initial scoping through evidence-based reporting, client debriefs and retesting, explaining technical issues clearly to both developers and business leaders.

Responsibilities - Perform manual tests for common web application and API security risks, including those covered by the OWASP Top 10 and OWASP API Security Top 10. - Connect individual vulnerabilities into realistic attack paths and demonstrate their impact with clear, repeatable evidence. - Write practical reports that help engineering teams remediate issues and help executives understand risk. - Present findings to clients and retest systems to confirm fixes. - Help improve internal testing tools and methods, and share knowledge with colleagues.

Requirements - At least two years of practical web or API penetration testing experience. - Strong knowledge of HTTP, authentication and authorization weaknesses, and common web frameworks. - Proficiency with Burp Suite and scripting in Python, Go or a similar language. - Clear written English and the ability to explain technical risk to non-specialists; Arabic is an advantage. - Based in Egypt or the Middle East, with authorization to work there.

Nice to have - A relevant certification such as OSCP, OSWE or CREST CRT. - Published vulnerability disclosures, a bug bounty record, or open-source security tooling. - Experience assessing GraphQL, gRPC or mobile back ends.