Lead Web Application Penetration Tester

Role Summary
This position involves leading advanced security assessments for modern web applications and APIs. The candidate will perform comprehensive penetration testing to identify vulnerabilities related to application logic, authentication, authorization, session management, and API security. The role requires a high level of technical expertise, manual testing skills, and experience with security tools to uncover high-impact risks in complex systems.

Responsibilities

• Lead and execute penetration tests targeting web applications, APIs, and associated services.
• Test complex business workflows such as user onboarding, checkout processes, account recovery, role escalation, and transaction handling.
• Conduct manual and automated security assessments using tools like Burp Suite, OWASP utilities, and other testing frameworks.
• Analyze API security, including object-level authorization, function-level controls, mass assignment, and broken references.
• Identify vulnerabilities in rate limiting, input validation, error handling, file uploads, and trust boundaries.
• Map applications and perform reconnaissance to identify endpoints, parameters, hidden functionality, and exposed surfaces.
• Test user roles, permissions, and privilege boundaries to identify privilege escalation issues.
• Probe session management, token handling, and session invalidation processes for weaknesses.
• Assess input handling for client-side and server-side validation issues, including edge cases and error-based disclosures.
• Provide remediation advice and security feedback to application owners, developers, and stakeholders.

Qualifications

• Proven experience in web application penetration testing.
• Proficiency with Burp Suite and related offensive security tools.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and GraphQL APIs.
• In-depth knowledge of authentication, authorization, session management, cookies, and tokens.
• Excellent report writing, communication, and remediation advisory skills.
• Ability to work independently and lead security assessments from planning to delivery.
• Knowledge of SAST, DAST, SCA, and API security tooling.
• Relevant education, training, certifications, or equivalent practical experience.

Publishing Pay Range: $55.00 - $60.00 USD Hourly
This position is based in office and requires employee to work on-site.