Senior Penetration Tester, API, Web & Cloud
D
DistribusionTravel technology
GermanyContractSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 5+ years of hands-on penetration testing
- Required Skills
- PythonKubernetesGo
Requirements
- Bring 5+ years of hands-on penetration testing, mainly of web applications and APIs, with recent engagements led end to end.
- Have practical knowledge of the OWASP API Security Top 10, WSTG and ASVS.
- Understand authentication and authorization models, including OAuth2/OIDC and JWT.
- Have experience with IDOR/BOLA, mass assignment, SSRF, injection and XSS.
- Have found business-logic and race-condition vulnerabilities in transactional systems such as booking, e-commerce, payments or fintech.
- Be fluent with Burp Suite Pro or similar.
- Write scripts and tooling in Python, Go or similar.
- Be comfortable assessing cloud and container environments, preferably GCP, Kubernetes and CI/CD pipelines.
- Be able to scope, prioritise, test and report independently with minimal guidance.
- Explain complex risks plainly to engineers and leadership.
- Be available to start at short notice.
- OSCP, OSWE, BSCP or similar certifications are a bonus.
- Experience red-teaming LLM applications or AI agents, or testing in PCI-DSS environments, is a bonus.
Responsibilities
- Test partner-facing booking APIs against the OWASP API Security Top 10.
- Assess API authentication and integrity, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing.
- Hunt for business-logic abuse, race conditions and pricing manipulation in booking, checkout, payment and refund flows.
- Run authenticated tests of web and mobile apps using OWASP WSTG and ASVS.
- Review cloud, Kubernetes and CI/CD configurations and secrets handling for application-related attack paths.
- Map and regularly test the internet-facing attack surface.
- Red-team AI features against the OWASP Top 10 for LLM Applications.
- Write reproducible, risk-rated findings with remediation guidance, walk engineers through fixes and verify them with retests.
View Full Description & ApplyYou'll be redirected to the employer's site
