Senior Offensive Security Engineer (Web & API)

- Contract

About You

You are an experienced offensive security professional with strong manual penetration testing expertise and a disciplined approach to testing production environments. You validate vulnerabilities through controlled exploitation attempts and produce clear, reproducible evidence.
You are comfortable testing web applications, REST/SOAP APIs, and applications protected by enterprise SSO. You understand how to assess authorization across roles and accounts, identify exploitable weaknesses, and explain their impact.

Note:This role operates under a contractor model for an initial period of 2 months, with the possibility of extension.

You Bring to Applaudo the Following Competencies:

- Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.
- 5+ years of hands on penetration testing experience, including 3+ years testing web applications and APIs in production environments.
- Manual web application penetration testing following OWASP WSTG and the OWASP Top 10.
- API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization.
- SOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool.
- Burp Suite Professional as your primary tool, including extensions and custom payloads.
- Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID.
- Multi role and multi account authorization testing methodology.
- External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling.




- Proven ability to test safely in production, applying rate control, test records and defined stop conditions.
- CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
- Strict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met.
- Documentation discipline that records every attempt, successful or not, so results stand up to regulatory review.
- Commitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables.
- Strong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team.

Nice to haves:

- Experience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms.
- Experience testing ASP.NET web applications and APIs.
- Experience with Azure API Management, Application Gateway or Front Door WAF.
- Experience testing payment, e signature and webhook or callback integrations.
- Python or Bash scripting to automate test cases.
- Prior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4 or FFIEC.
- Offensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN or BSCP.





You Will Be Accountable for the Following Responsibilities:

- Perform outside unauthenticated testing of in scope web applications, REST and SOAP APIs, an API gateway and internet exposed hosts.
- Perform inside testing from client provided accounts, covering cross role and cross account authorization, privilege escalation and access beyond the assigned role.
- Discover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.
- Base every finding on an exploitation attempt and record its result, listing scan only items separately as untested.
- Test all authorized in scope assets, or document the reason for exclusion when client side dependencies are not met.
- Execute all testing without causing service disruption or data loss, escalating stop conditions within one hour.
- Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
- Contribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.
- Support the revalidation report delivered within 60 days of the final report.
- Report weekly status in English and participate in working sessions with the client security team.

- 5+ years of hands on penetration testing, including 3+ years on web applications and APIs in production.
- Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
- Burp Suite Professional expertise, including SOAP and WSDL service testing.
- Authorization testing across multiple roles and accounts in SSO pro

📌 Senior Offensive Security Engineer (Ciudad de México)
🏢 Applaudo Studios
📍 Ciudad de México