Senior Offensive Security Engineer

You are an experienced offensive security professional with strong manual penetration testing expertise and a disciplined approach to testing production environments. You validate vulnerabilities through controlled exploitation attempts and produce clear, reproducible evidence.

You are comfortable testing web applications, REST/SOAP APIs, and applications protected by enterprise SSO. You understand how to assess authorization across roles and accounts, identify exploitable weaknesses, and explain their impact.

Note: This role operates under a contractor model for an initial period of 2 months, with the possibility of extension.

You Bring to Applaudo the Following Competencies:

• Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
• 5+ years of hands on penetration testing experience, including 3+ years testing web applications and APIs in production environments.
• Manual web application penetration testing following OWASP WSTG and the OWASP Top 10.
• API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization.
• SOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool.
• Burp Suite Professional as your primary tool, including extensions and custom payloads.
• Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID.
• Multi role and multi account authorization testing methodology.
• External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling.
• Proven ability to test safely in production, applying rate control, test records and defined stop conditions.
• CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
• Strict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met.
• Documentation discipline that records every attempt, successful or not, so results stand up to regulatory review.
• Commitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables.
• Strong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team.

Nice to haves:

• Experience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms.
• Experience testing ASP.NET web applications and APIs.
• Experience with Azure API Management, Application Gateway or Front Door WAF.
• Experience testing payment, e signature and webhook or callback integrations.
• Python or Bash scripting to automate test cases.
• Prior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4 or FFIEC.
• Offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN or BSCP.

You Will Be Accountable for the Following Responsibilities:

• Perform outside unauthenticated testing of in scope web applications, REST and SOAP APIs, an API gateway and internet exposed hosts.
• Perform inside testing from client provided accounts, covering cross role and cross account authorization, privilege escalation and access beyond the assigned role.
• Discover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.
• Base every finding on an exploitation attempt and record its result, listing scan only items separately as untested.
• Test all authorized in scope assets, or document the reason for exclusion when client side dependencies are not met.
• Execute all testing without causing service disruption or data loss, escalating stop conditions within one hour.
• Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
• Contribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.
• Support the revalidation report delivered within 60 days of the final report.
• Report weekly status in English and participate in working sessions with the client security team.

Qualifications

• 5+ years of hands on penetration testing, including 3+ years on web applications and APIs in production.
• Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
• Burp Suite Professional expertise, including SOAP and WSDL service testing.
• Authorization testing across multiple roles and accounts in SSO protected applicati