AppSec Engineer

This is a fully remote position, open to applicants in Colombia.

📋 Description

• Plan, execute, and document penetration tests on web applications, mobile (Android/iOS), and APIs.

• Implement methodologies and frameworks (OWASP Web Top 10, OWASP API Security, OWASP MASVS/MSTG, etc.).

• Utilize tools such as Burp Suite (or similar), proxies, scanners, fuzzers, and analysis tools.

• Design and execute test cases focused on authentication, authorization, session management, input validation, cryptography, and exposure of sensitive data.

• Generate reproducible technical Proofs of Concept (PoC) that demonstrate the impact of identified vulnerabilities.

• Collaborate with development teams to prioritize, remediate, and retest findings.

• Work alongside the AppSec/DevSecOps team on Threat Modeling activities and purple teaming.

• Participate in red teaming exercises when required, including advanced attack simulations.

• Create clear and actionable reports for both technical and non-technical audiences (engineering, product, management).

⛳️ Requirements

• Proven experience in penetration testing for web applications, mobile, and/or APIs.

• Strong knowledge of OWASP Top 10, OWASP API Security, and OWASP mobile guidelines (MASVS/MSTG).

• Proficiency with penetration testing tools: Burp Suite, OWASP ZAP, HTTP proxies, fuzzers, and static/dynamic analysis tools, as well as instrumentation/emulation tools for mobile.

• Good understanding of modern authentication/authorization mechanisms (JWT, OAuth2, OIDC, etc.).

• Knowledge of networking, HTTP/HTTPS, DNS, and basic security concepts in cloud environments.

• Ability to write scripts or small tools in Python, JavaScript, Bash, or other languages for automating tests or exploitation.

• Skill in documenting findings clearly, in a structured manner, and focused on remediation.

🏝️ Benefits

• Work in a trusted environment.

• Participate in the mission of financial inclusion.