Senior Offensive Security Engineer (Web & API)

Applaudo Studios

About The Position

Applaudo seeks an experienced offensive security professional to perform manual penetration testing of web applications, REST and SOAP APIs, API gateways, and internet-exposed hosts. The role includes both unauthenticated external testing and authenticated testing using client-provided accounts, with particular attention to authorization across roles and accounts, privilege escalation, and access beyond assigned permissions. Testing may involve enterprise SSO, including OAuth 2.0, OpenID Connect, SAML, and Microsoft Entra ID. The engineer is expected to test safely in production, follow rules of engagement, document every testing attempt, and escalate stop conditions within one hour. Findings must be based on exploitation attempts, scored using CVSS v3.1, and supported by reproducible evidence suitable for regulatory review. The role contributes to draft and final reports, a signed attestation letter covering outside, inside application, and inside identity perspectives, and a revalidation report delivered within 60 days of the final report. The engineer also provides weekly status reports in English and participates in working sessions with the client security team. This role operates under a contractor model for an initial period of two months, with the possibility of extension.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
At least 5 years of hands-on penetration testing experience, including at least 3 years testing web applications and APIs in production environments.
Manual web application penetration testing following OWASP WSTG and the OWASP Top 10.
API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function-level authorization.
SOAP and WSDL web service testing using Burp Suite, SoapUI, or an equivalent tool.
Expertise with Burp Suite Professional as a primary tool, including extensions and custom payloads.
Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect, and SAML on Microsoft Entra ID.
A multi-role and multi-account authorization testing methodology.
External reconnaissance and attack-surface enumeration using Amass, subfinder, httpx, Nmap, or equivalent tools.
Ability to test safely in production using rate control, test records, and defined stop conditions.
CVSS v3.1 scoring and regulator-ready reporting supported by reproducible evidence.
Strict adherence to rules of engagement, including stopping and escalating within one hour when a stop condition is met.
Documentation discipline that records every attempt, successful or not, to support regulatory review.
Commitment to collecting only the minimum evidence required and masking nonpublic information in deliverables.
Strong spoken and written English (B2+) to document findings and weekly status reports and participate in live working sessions with a U.S.-based security team.

Nice To Haves

Experience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms.
Experience testing ASP.NET web applications and APIs.
Experience with Azure API Management, Application Gateway, or Front Door WAF.
Experience testing payment, e-signature, and webhook or callback integrations.
Python or Bash scripting to automate test cases.
Prior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4, or FFIEC.
An offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN, or BSCP.

Responsibilities

Perform outside unauthenticated testing of in-scope web applications, REST and SOAP APIs, an API gateway, and internet-exposed hosts.
Conduct inside testing using client-provided accounts, including cross-role and cross-account authorization testing, privilege escalation testing, and assessment of access beyond assigned roles.
Discover API specifications, such as OpenAPI, WSDL, and Postman collections, before testing when required.
Base every finding on an exploitation attempt and record the result; list scan-only items separately as untested.
Test all authorized in-scope assets, or document the reason for exclusion when client-side dependencies are not met.
Conduct testing without causing service disruption or data loss, and escalate stop conditions within one hour.
Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
Contribute to the draft report, final report, and signed attestation letter covering outside, inside application, and inside identity perspectives.
Support the revalidation report delivered within 60 days of the final report.
Report weekly status in English and participate in working sessions with the client security team.
Collect only the minimum evidence required and mask nonpublic information in deliverables.
Follow rules of engagement and document every testing attempt, whether successful or not.