Senior Offensive Security Engineer (Web & API)
Applaudo Studios9 hours ago
Remote, Mexico or Mexico City, MexicoSenior
Responsibilities
- Perform unauthenticated and authenticated penetration testing of web applications, REST and SOAP APIs, API gateways, and internet-exposed hosts.
- Test authorization across multiple roles and accounts, including privilege escalation and access beyond assigned permissions.
- Discover and review API specifications such as OpenAPI, WSDL, and Postman collections before testing.
- Base findings on controlled exploitation attempts, record successful and unsuccessful attempts, and separate scan-only items as untested.
- Test authorized assets safely in production without service disruption or data loss, documenting exclusions when client dependencies are unmet.
- Follow rules of engagement, defined stop conditions, evidence-minimization requirements, and masking requirements for nonpublic information.
- Score findings using CVSS v3.1 and produce reproducible evidence suitable for regulatory review.
- Contribute to draft and final reports, signed attestation letters, and revalidation reports delivered within 60 days of the final report.
- Provide weekly status reports in English and participate in working sessions with the client security team.
Requirements
- At least 5 years of hands-on penetration-testing experience, including at least 3 years testing web applications and APIs in production environments.
- Manual web application testing experience aligned with OWASP WSTG and the OWASP Top 10.
- API security testing experience aligned with the OWASP API Security Top 10, including BOLA/IDOR and broken function-level authorization.
- Expertise with Burp Suite Professional, including extensions and custom payloads.
- Experience testing SOAP and WSDL services using SoapUI or an equivalent tool.
- Experience testing SSO-protected applications using Microsoft Entra ID, OAuth 2.0, OpenID Connect, and SAML.
- Experience with multi-role and multi-account authorization testing, production-safe testing, CVSS v3.1 scoring, and regulatory-ready reporting.
- Strong spoken and written English at B2+ level.
- A bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
- Preferred experience includes Java EE and JSF applications, ASP.NET applications and APIs, Azure API Management, Application Gateway, Front Door WAF, payment and e-signature integrations, webhooks or callbacks, and Python or Bash scripting.
- Preferred experience includes regulatory penetration testing under NYDFS Part 500, PCI DSS 11.4, or FFIEC.
- Preferred offensive security certifications include OSCP, OSWE, GWAPT, GPEN, GXPN, or BSCP.
Benefits
- Initial contractor engagement for 2 months, with the possibility of extension.
About Applaudo Studios
Applaudo Studios provides nearshore software engineering and AI consulting to enterprises, delivering product design, custom development, cloud, and data services from Latin America. Founded in 2013 and headquartered in San Salvador, the privately held firm builds and operates web, mobile, and enterprise systems and supports digital transformation initiatives. Clients engage Applaudo for AI assessments and implementation, scalable delivery teams, and ongoing DevOps and QA support.