Senior Software Engineer - Digital & Ops

Requirements

• Strong hands‑on experience conducting manual web application penetration tests
• Deep knowledge of OWASP Web/API/Mobile Top 10 vulnerabilities
• Ability to perform:
• Experience following OWASP WSTG and structured test procedures
• Hands‑on experience testing RESTful APIs using authenticated and unauthenticated contexts
• Ability to test - Authorization controls and role separation, Token handling, API keys, OAuth/JWT misuse, Rate limiting, pagination, and business logic abuse
• Experience integrating API testing into broader application assessments
• Experience testing mobile applications with backend API dependency awareness
• Ability to assess client‑side vs server‑side trust boundaries
• Hands‑on experience performing internal and external infrastructure penetration tests
• Knowledge of - Network service enumeration (SMB, RDP, LDAP, MSSQL, HTTP/S), Firewall, VPN, and cloud endpoint misconfigurations, Active Directory attacks (Kerberoasting, AS‑REP roasting, privilege escalation)
• Ability to validate - Lateral movement paths, Privilege escalation vectors, Credential reuse and weak permissions
• Experience aligning infrastructure testing with PTES methodology
• Strong understanding of PTES phases
• Ability to scope, execute, and document full‑cycle penetration tests
• Experience validating exploitability and business impact, not just scanner findings
• Ability to perform retesting and confirm remediation closure
• Proficient with industry‑standard security testing tools, including: Burp Suite (manual testing, extensions, API testing), Nmap, SQLmap
• Ability to combine automated scanning with manual exploitation for accurate findings
• Experience working within a Secure Software Development Lifecycle (SSDLC)
• Perform architecture reviews and threat modeling (e.g., STRIDE)
• Support static, dynamic, and manual security testing efforts
• Strong experience producing clear, actionable penetration test reports
• Track findings through remediation lifecycle