Senior Offensive Security Engineer (Web & API)
Read straight from Applaudo Studios's careers page, verified 3d ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationMexico City, CDMX, mx
Work moderemote
Typecontract
SenioritySenior
Experience5+ yrs
DepartmentInformation & Security
Company size501–1,000 people
PostedOct 29, 2026 · 1w ago
Verified live3d ago
At a glanceSummarised by Seekless from the posting.
5+ years of hands-on penetration testing experience
3+ years testing web applications and APIs in production environments
Manual web application penetration testing following OWASP WSTG and the OWASP Top 10
API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization
SOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool
Burp Suite Professional as your primary tool, including extensions and custom payloads
Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID
Multi role and multi account authorization testing methodology
External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling
Proven ability to test safely in production, applying rate control, test records and defined stop conditions
CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence
Strict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met
Documentation discipline that records every attempt, successful or not, so results stand up to regulatory review
Commitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables
Strong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team
Experience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms
Experience testing ASP.NET web applications and APIs
Experience with Azure API Management, Application Gateway or Front Door WAF
Experience testing payment, e signature and webhook or callback integrations
Python or Bash scripting to automate test cases
Prior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4 or FFIEC
Offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN or BSCP
Skills
REST/SOAP API
Burp Suite
SoapUI
OWASP WSTG
OWASP Top 10
OWASP API Security Top 10
CVSS v3.1
Amass
subfinder
httpx
Nmap
Python
Bash
Microsoft Entra ID
OAuth 2.0
OpenID Connect
SAML
Java EE
JSF
ASP.NET
Azure API Management
Application Gateway
Front Door WAF
Job Description
About You
You are an experienced offensive security professional with strong manual penetration testing expertise and a disciplined approach to testing production environments. You validate vulnerabilities through controlled exploitation attempts and produce clear, reproducible evidence.
You are comfortable testing web applications, REST/SOAP APIs, and applications protected by enterprise SSO. You understand how to assess authorization across roles and accounts, identify exploitable weaknesses, and explain their impact.
Note: This role operates under a contractor model for an initial period of 2 months, with the possibility of extension.
You Bring to Applaudo the Following Competencies:
•
Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
•
5+ years of hands on penetration testing experience, including 3+ years testing web applications and APIs in production environments.
•
Manual web application penetration testing following OWASP WSTG and the OWASP Top 10.
•
API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization.
•
SOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool.
•
Burp Suite Professional as your primary tool, including extensions and custom payloads.
•
Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID.
•
Multi role and multi account authorization testing methodology.
•
External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling.
•
Proven ability to test safely in production, applying rate control, test records and defined stop conditions.
•
CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
•
Strict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met.
•
Documentation discipline that records every attempt, successful or not, so results stand up to regulatory review.
•
Commitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables.
•
Strong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team.
Nice to haves:
•
Experience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms.
•
Experience testing ASP.NET web applications and APIs.
•
Experience with Azure API Management, Application Gateway or Front Door WAF.
•
Experience testing payment, e signature and webhook or callback integrations.
•
Python or Bash scripting to automate test cases.
•
Prior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4 or FFIEC.
•
Offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN or BSCP.
You Will Be Accountable for the Following Responsibilities:
•
Perform outside unauthenticated testing of in scope web applications, REST and SOAP APIs, an API gateway and internet exposed hosts.
•
Perform inside testing from client provided accounts, covering cross role and cross account authorization, privilege escalation and access beyond the assigned role.
•
Discover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.
•
Base every finding on an exploitation attempt and record its result, listing scan only items separately as untested.
•
Test all authorized in scope assets, or document the reason for exclusion when client side dependencies are not met.
•
Execute all testing without causing service disruption or data loss, escalating stop conditions within one hour.
•
Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
•
Contribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.
•
Support the revalidation report delivered within 60 days of the final report.
•
Report weekly status in English and participate in working sessions with the client security team.
Qualifications
•
5+ years of hands on penetration testing, including 3+ years on web applications and APIs in production.
•
Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
•
Burp Suite Professional expertise, including SOAP and WSDL service testing.
•
Authorization testing across multiple roles and accounts in SSO protected applications (Entra ID, OAuth 2.0, OIDC, SAML).
Additional Information
About Us
We Are Engineered Different.
At Applaudo, talented people design, build, and scale meaningful, AI-powered solutions that create real business impact. As an AI-native organization, we collaborate across design, development, cloud, data, and artificial intelligence to turn ideas into scalable products that transform how companies operate, make decisions, and grow.
We are building a high-performance culture grounded in five values: Empowering Excellence, Collaborative Teamwork, Unsolicited Respect, Consistent Transparency, and Efficient Communication. These define how we work, how we support one another, and how we hold ourselves accountable.
Applaudo is a place for people who want to learn fast, take ownership, and work alongside strong teams they are proud to belong to. Joining us means being part of an organization that is evolving intentionally, investing in modern ways of working, and leading AI-native transformation at scale.