Description

Execute manual and automated penetration testing across web, mobile, and API endpoints.

This role is on-site.

Responsibilities

• Simulate attack scenarios using OWASP Top 10, SANS Top 25, and API Security Top 10 frameworks.
• Develop proof-of-concept exploits and custom payloads to demonstrate risk severity.
• Document findings with reproduction steps, impact analysis, and mitigation recommendations.
• Integrate testing results into CI/CD pipelines to support DevSecOps practices.

Required Skills

• 5–8 years of experience in application or API penetration testing.
• 3+ years of hands-on offensive testing experience.
• Deep understanding of HTTP/HTTPS, REST, GraphQL, JSON, and XML protocols.
• Proficiency in Python, JavaScript, or Bash scripting.
• Experience with vulnerability exploitation, reverse engineering, or red team engagements.
• Proficiency with Burp Suite Professional for traffic interception and exploitation.
• Experience testing REST and GraphQL APIs, including JWT and OAuth.
• Bachelor’s or Master’s degree in Computer Science, Information Security, or related field.

Preferred Skills

• Familiarity with API gateways (e.g., Kong, Apigee) and microservices architectures.
• Awareness of cloud-native security testing (AWS, Azure, GCP) and container security (Docker/Kubernetes).

Key Skills

Education

Bachelor's or Master's degrees