Senior Penetration Tester (Web and API)

Role overview Lead scoped penetration tests of web applications and APIs, from planning through retesting. The work is primarily manual and aims to find, safely demonstrate, and clearly explain security issues in ways that support both engineering remediation and compliance evidence.

Responsibilities - Test web applications and APIs across user roles, covering areas such as authentication, authorization, sessions, injection, business logic, server-side request forgery, file handling, and deserialization. - Verify automated findings by hand, connect related weaknesses into realistic attack paths, and demonstrate impact within the agreed rules of engagement. - Escalate critical issues promptly after confirmation. - Produce reports with an executive summary, reproducible technical findings, CVSS scores, prioritized remediation, and relevant framework mappings. - Retest remediated findings and revise the report. - Participate in client scoping calls when tester input is needed.

Requirements - At least five years of hands-on application penetration testing, with most experience focused on web and API testing. - Deep testing experience with at least one modern application pattern, such as single-page applications, GraphQL, OAuth or OIDC flows, or multi-tenant SaaS. - Based in the United States and authorized to work there; engagements follow US time zones. - Able to write reports that give engineers clear remediation steps and provide auditors with reviewable evidence; a redacted sample report is required with the application. - Comfortable working to a written scope, raising concerns early, and providing two professional references who have seen live engagement work.

Nice to have - Mobile testing experience using MASVS or MASTG, or cloud testing on AWS, Azure, or GCP. - Published security research, testing tools, or disclosed vulnerabilities in third-party software. - An offensive security certification; practical engagement experience is also required.

Benefits and work setup Full-time, remote employment within the United States. A typical engagement involves five to ten testing days plus a retest. Initial onboarding to the testing platform and reporting templates takes about one day.