Description

You will perform manual and automated penetration testing across web, mobile, and API endpoints.

Responsibilities

• Perform manual and automated penetration testing on web, mobile, and API endpoints.
• Simulate attack scenarios using OWASP Top 10, SANS 25, and API Security Top 10 frameworks.
• Execute custom payloads and develop PoC exploits to demonstrate risk severity.
• Document findings with reproduction steps, impact analysis, and mitigation recommendations.
• Integrate testing results into CI/CD pipelines to support DevSecOps practices.

Required Skills

• 5–8 years of experience in application or API penetration testing, with 3+ years in hands-on offensive testing.
• Deep understanding of HTTP/HTTPS, REST, GraphQL, JSON, and XML protocols.
• Proficiency in scripting languages such as Python, JavaScript, or Bash.
• Experience with vulnerability exploitation, reverse engineering, or red team engagements.
• Familiarity with Burp Suite Professional for traffic interception and exploitation.
• Experience testing REST and GraphQL APIs, including JWT and OAuth.
• Knowledge of security frameworks like MITRE ATT&CK and CWE.
• Bachelor’s or Master’s degree in Computer Science, Information Security, or related field.
• Skills in using Postman, Burp Suite, and OWASP ZAP.

Preferred Skills

• Familiarity with API gateways (e.g., Kong, Apigee) and microservices architectures.
• Awareness of cloud-native security testing (AWS, Azure, GCP) and container security (Docker/Kubernetes).

Key Skills

Education

Bachelor's or Master's degrees