Senior Consultant, Web Application Pen Testing

Job summary

This role involves conducting advanced web application and API penetration testing, focusing on identifying and exploiting vulnerabilities in complex systems. The position requires a deep understanding of offensive security techniques and the ability to communicate findings effectively to both technical and executive audiences.

Qualifications

• Bachelor's degree or equivalent practical experience in Computer Science, Cybersecurity, or a related field.
• 5 years of experience in offensive security, particularly in manual web application and API testing.
• Experience with operating system security across Linux, Windows, and macOS.

Responsibilities

• Engage in external phases of larger Red Team assessments, utilizing web application compromises to gain initial access.
• Perform thorough manual penetration testing of web applications, APIs, microservices, and mobile backends, with an emphasis on complex business logic vulnerabilities.
• Conduct security research to discover new exploitation techniques and develop custom tools.
• Write detailed technical reports that outline exploitation steps, proof-of-concepts, and remediation strategies for developers and executives.
• Serve as a technical lead on projects, assisting in scoping, guiding delivery, and mentoring junior consultants.

Skills

• Proficiency in scripting and programming languages such as Python, JavaScript, or Go.
• Familiarity with the OWASP Top 10 and advanced exploitation techniques for modern frameworks and APIs.
• Understanding of network protocols, system administration, and incident response processes.

Education

• Relevant industry certifications such as OSWE, GWAPT, OSCP, eWPTX, or CCT APP are preferred.

Tools

• Experience with security assessment tools and methodologies for web applications and APIs.