Senior Web & API Penetration Tester

MHMarkets; Dubai; On-site; AED 180,000 - 300,000; Full time

Job summary

MHMarkets is seeking an experienced penetration tester to conduct manual testing of web apps, REST, GraphQL APIs and WebSockets in a trading environment. You will identify OWASP Top 10 and API security vulnerabilities and develop custom scripts to uncover issues missed by automation.

You will produce detailed reports with steps, risk ratings, business impact, and remediation guidance, and coordinate with DevSecOps and Infrastructure teams for remediation validation and retesting.

Qualifications

• 3+ years of hands-on experience in web application and API penetration testing.
• Strong practical knowledge of web application security and penetration testing methodologies.
• Experience testing REST APIs, GraphQL, WebSockets, and modern web applications.
• Strong scripting/programming skills in Python, JavaScript, Bash, or similar languages.
• Understanding of AWS and/or Microsoft Azure environments and cloud-based web service architectures.
• Ability to independently manage penetration testing engagements from scoping and testing through reporting and remediation validation.

Responsibilities

• Conduct manual penetration testing of web applications, REST, GraphQL APIs, and WebSockets.
• Identify vulnerabilities aligned with OWASP Top 10 and OWASP API Security Top 10.
• Test financial and trading-specific business logic for vulnerabilities.
• Develop custom scripts and techniques to identify issues not caught by automated scanners.
• Produce detailed penetration testing reports with reproducible steps, risk ratings, and remediation recommendations.
• Work with Development, DevSecOps and Infrastructure teams to validate remediation and perform retesting.

Skills

Penetration testing

Web security

API security

Python

JavaScript

Bash

Burp Suite

Cloud platforms (AWS/Azure)

Reporting & remediation validation

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field

Tools

Burp Suite

Job description

MHMarkets is seeking an experienced penetration tester to conduct manual testing of web apps, REST, GraphQL APIs and WebSockets in a trading environment. You will identify OWASP Top 10 and API security vulnerabilities and develop custom scripts to uncover issues missed by automation.

You will produce detailed reports with steps, risk ratings, business impact, and remediation guidance, and coordinate with DevSecOps and Infrastructure teams for remediation validation and retesting.