Senior Offensive Security Engineer, Web & API

This is a fully remote position, open to applicants in Mexico.

📋 Description

• Conduct external unauthenticated assessments of designated web applications, REST and SOAP APIs, API gateways, and publicly accessible hosts.

• Perform internal assessments using client-provided accounts, focusing on cross-role and cross-account authorization, privilege elevation, and access beyond designated roles.

• Identify API specifications such as OpenAPI, WSDL, and Postman collections prior to testing as necessary.

• Base each finding on an attempted exploitation and document its outcomes; categorize scan-only items separately as untested.

• Evaluate all authorized in-scope assets or document exclusions when client-side dependencies are unmet.

• Carry out testing without causing service interruptions or data loss.

• Report any stop conditions within one hour.

• Assess findings using CVSS v3.1 and provide reproducible evidence suitable for regulatory scrutiny.

• Assist in drafting and finalizing reports as well as the signed attestation letter covering both external and internal application and identity perspectives.

• Aid in the revalidation report to be delivered within 60 days of the final report.

• Provide weekly updates in English.

• Engage in collaborative sessions with the client’s security team.

⛳️ Requirements

• A Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related discipline is preferred, or equivalent professional experience.

• Over 5 years of practical experience in penetration testing.

• More than 3 years of experience testing web applications and APIs in live environments.

• Proficiency in manual web application penetration testing adhering to OWASP WSTG and OWASP Top 10 guidelines.

• Experience in API security testing according to the OWASP API Security Top 10, including BOLA/IDOR and broken function-level authorization.

• Testing of SOAP and WSDL web services using Burp Suite, SoapUI, or a comparable tool.

• Advanced knowledge of Burp Suite Professional, including its extensions and custom payloads.

• Familiarity with testing SSO-protected applications utilizing OAuth 2.0, OpenID Connect, and SAML on Microsoft Entra ID.

• Methodology for multi-role and multi-account authorization testing.

• Conduct external reconnaissance and attack surface enumeration using tools such as Amass, subfinder, httpx, Nmap, or similar.

• Capability to perform safe testing in production environments using rate control, test records, and defined stop conditions.

• Proficiency in CVSS v3.1 scoring and regulatory-compliant reporting supported by reproducible evidence.

• Strict adherence to engagement rules and the ability to halt and escalate within one hour upon encountering a stop condition.

• Strong documentation practices, recording every attempt, whether successful or not.

• Commitment to collecting only the essential evidence and concealing non-public information.

• Excellent spoken and written English proficiency at the B2+ level.

• Experience with Java EE and JSF enterprise applications is a plus.

• Experience with ASP.NET web applications and APIs is a plus.

• Familiarity with Azure API Management, Application Gateway, or Front Door WAF is a plus.

• Experience testing payment systems, e-signature solutions, and webhook or callback integrations is a plus.

• Knowledge of Python or Bash scripting is a plus.

• Participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4, or FFIEC is a plus.

• Possession of offensive security certifications such as OSCP, OSWE, GWAPT, GPEN, GXPN, or BSCP is a plus.

🏝️ Benefits

• Initial contractor engagement for a period of 2 months, with the potential for extension.

• Options for remote work.

• Opportunity to collaborate with a U.S.-based security team.

• Involvement in contemporary, AI-driven transformation initiatives.

• Opportunities for learning and ownership.

• Collaboration with robust cross-functional teams.