Senior Offensive Security Engineer (Web/API Pentester)

Applaudo; Colombia; On-site; COP 123,984,000 - 165,312,000; Part time

Job summary

Applaudo is seeking an experienced offensive security professional to perform production-grade penetration testing across web applications, APIs, and an API gateway. You will validate vulnerabilities through controlled exploitation and document evidence for regulatory review.

The contractor role lasts an initial 2 months with potential extension. You will work with a U.S.-based security team, applying strict stop conditions and comprehensive records of all testing efforts.

Qualifications

• 5+ years of hands on penetration testing experience including 3+ years on web apps and APIs in production.
• Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
• Burp Suite Pro expertise with SOAP/WSDL testing.
• SSO protected applications (Entra ID, OAuth 2.0, OIDC, SAML).
• Experience testing in production with proper stop conditions and documentation.

Responsibilities

• Perform outside unauthenticated testing of in-scope web apps, REST and SOAP APIs, an API gateway, and internet exposed hosts.
• Test inside with client-provided accounts, covering cross-role authorization and privilege escalation.
• Discover API specifications OpenAPI/WSDL for REST and SOAP services when required.
• Record findings with exploitation-based evidence and separate untested items.
• Produce regulatory-ready reports with reproducible evidence and attestation.

Skills

Penetration testing

OWASP WSTG

Burp Suite

API security

SSO

Education

Bachelor's degree

Tools

Burp Suite Pro

SoapUI

Nmap

Amass

subfinder

Job description

Applaudo is seeking an experienced offensive security professional to perform production-grade penetration testing across web applications, APIs, and an API gateway. You will validate vulnerabilities through controlled exploitation and document evidence for regulatory review.

The contractor role lasts an initial 2 months with potential extension. You will work with a U.S.-based security team, applying strict stop conditions and comprehensive records of all testing efforts.