Senior Offensive Security Engineer (Web & API)

About the role

Applaudo is looking for an experienced offensive security professional with strong manual penetration testing expertise to test production web applications, REST/SOAP APIs and applications protected by enterprise SSO. The role is a contractor engagement for an initial period of 2 months, with the possibility of extension. You will validate vulnerabilities through controlled exploitation attempts and produce clear, reproducible evidence.

Key responsibilities

• Perform outside unauthenticated testing of in-scope web applications, REST and SOAP APIs, an API gateway and internet-exposed hosts.
• Perform inside testing from client-provided accounts, covering cross-role and cross-account authorization, privilege escalation and access beyond the assigned role.
• Discover API specifications (OpenAPI, WSDL, Postman collections) before testing when required.
• Base every finding on an exploitation attempt and record its result; list scan-only items separately as untested.
• Test all authorized in-scope assets, or document the reason for exclusion when client-side dependencies are not met.
• Execute all testing without service disruption or data loss, escalating stop conditions within one hour.
• Score findings with CVSS v3.1 and document reproducible evidence suitable for regulatory review.
• Contribute to the draft report, final report and signed attestation letter, and support the revalidation report within 60 days.
• Report weekly status in English and take part in working sessions with the client's security team.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering or a related field, or equivalent professional experience.
• 5+ years of hands-on penetration testing, including 3+ years testing web applications and APIs in production.
• Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
• Strong spoken and written English (B2+).
• Nice to have: prior regulatory penetration tests (NYDFS Part 500, PCI DSS 11.4, FFIEC), offensive security certifications (OSCP, OSWE, etc.), and experience with Java EE, ASP.NET, Azure WAFs, Python or Bash scripting.

Required skills

• Burp Suite Professional, including extensions and custom payloads, and SOAP/WSDL testing with Burp, SoapUI or equivalents.
• Authorization testing across multiple roles and accounts in SSO-protected apps (Microsoft Entra ID, OAuth 2.0, OpenID Connect, SAML).
• External reconnaissance and attack surface enumeration with Amass, subfinder, httpx, Nmap or equivalents.