Description

You will execute penetration tests focused on enterprise web applications and modern APIs.

This role is on-site.

Responsibilities

• Plan, execute, and document manual and tool-assisted tests against web apps and REST/GraphQL/gRPC APIs.
• Demonstrate exploitation paths, including authentication, logic flaws, and data exposure, and develop proofs-of-concept.
• Facilitate Threat Modeling sessions using STRIDE-like frameworks for new or modified services, and produce risk artifacts.
• Champion secure-by-default patterns across the Software Development Lifecycle (SDLC), including IaC hardening and SDL best practices.
• Re-test remediation efforts and deliver clear, prioritized security reports.

Required Skills

• 4+ years in product or application security engineering with hands-on web/API penetration-testing experience.
• Expertise with a leading penetration testing platform (e.g., Burp Suite Pro, OWASP ZAP).
• Proficiency in scripting/automation using Python, Go, or similar languages.
• Practical experience applying STRIDE or comparable threat-modeling frameworks.
• Familiarity with cloud-native environments, including microservices and Kubernetes.
• Bachelor's degree in Computer Science, Engineering, or equivalent practical experience.
• Exceptional written and verbal communication skills for technical and non-technical audiences.
• Experience with CI/CD processes and guardrails.

Preferred Skills

• Offensive-security certifications such as OSCP, OSWE, or OSWA.
• Secure-coding experience in Java, Node.js, C#, Python, or Rust.
• Experience with security controls for AWS or Azure.

Key Skills

Education

Bachelor's degree