Senior Offensive Security Engineer, Web & API

🔥 12 minutes ago

🇲🇽 Mexico – Remote

⏳ Contract/Temporary

🟠 Senior

💻 Frontend Engineer / Web Developer

👻 Ghost score 10%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Applaudo

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2013

💼 Consulting

📣 Marketing

📦 Logistics

Consulting • Marketing • Logistics

Applaudo is a nearshore software development company that helps businesses accelerate their digital transformation. With over a decade of experience, Applaudo partners with some of the world’s most admired brands to streamline IT solutions, optimize delivery costs, and modernize their digital infrastructure. The company offers a range of services including innovation and experience design, development and maintenance, quality assurance, cloud solutions, artificial intelligence, and cybersecurity. Applaudo is known for its expertise in data solutions and app modernization, and has a strong presence in industries like sports, media and entertainment, retail, consumer packaged goods, and financial services. Headquartered in Austin, TX with offices in San Salvador, Applaudo blends top-tier software development talent with cutting-edge technology to drive business growth for its clients.

📋 Description

• Perform outside unauthenticated testing of in-scope web applications, REST and SOAP APIs, API gateways, and internet-exposed hosts • Perform inside testing using client-provided accounts, covering cross-role and cross-account authorization, privilege escalation, and access beyond assigned roles • Discover API specifications such as OpenAPI, WSDL, and Postman collections before testing when required • Base every finding on an exploitation attempt and record its result; list scan-only items separately as untested • Test all authorized in-scope assets or document exclusions when client-side dependencies are not met • Execute testing without causing service disruption or data loss • Escalate stop conditions within one hour • Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review • Contribute to draft and final reports and the signed attestation letter covering outside, inside application, and inside identity perspectives • Support the revalidation report delivered within 60 days of the final report • Report weekly status in English • Participate in working sessions with the client security team

🎯 Requirements

• Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience • 5+ years of hands-on penetration testing experience • 3+ years testing web applications and APIs in production environments • Manual web application penetration testing following OWASP WSTG and OWASP Top 10 • API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization • SOAP and WSDL web service testing using Burp Suite, SoapUI, or an equivalent tool • Burp Suite Professional expertise, including extensions and custom payloads • Experience testing SSO-protected applications with OAuth 2.0, OpenID Connect, and SAML on Microsoft Entra ID • Multi-role and multi-account authorization testing methodology • External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap, or equivalent tooling • Ability to test safely in production using rate control, test records, and defined stop conditions • CVSS v3.1 scoring and regulator-ready reporting supported by reproducible evidence • Strict adherence to rules of engagement and ability to stop and escalate within one hour when a stop condition is met • Documentation discipline recording every attempt, successful or not • Commitment to collecting only minimum required evidence and masking nonpublic information • Strong spoken and written English at B2+ level • Nice-to-have experience with Java EE and JSF enterprise applications • Nice-to-have experience with ASP.NET web applications and APIs • Nice-to-have experience with Azure API Management, Application Gateway, or Front Door WAF • Nice-to-have experience testing payment, e-signature, and webhook or callback integrations • Nice-to-have Python or Bash scripting experience • Nice-to-have participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4, or FFIEC • Nice-to-have offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN, or BSCP

🏖️ Benefits

• Contractor engagement for an initial period of 2 months, with possibility of extension • Remote work availability • Opportunity to work with a U.S.-based security team • Participation in modern, AI-native transformation initiatives • Learning and ownership opportunities • Collaboration with strong cross-functional teams

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume