Contract Offensive Security Engineer - Web and API Pentester

Applaudo; Ciudad de México; On-site; MXN 1,815,000 - 3,112,000; Full time

Job summary

Applaudo is seeking an experienced offensive security professional to perform production-grade penetration testing of web applications, REST/SOAP APIs, and SSO-protected services. The contractor role lasts an initial 2 months with potential extension, requiring strong manual testing and precise evidence collection.

You will work with a U.S.-based security team, document findings with reproducible evidence, and adhere to strict engagement rules while protecting production environments.

Qualifications

• 5+ years of hands on penetration testing experience, including 3+ years testing web applications and APIs in production environments.
• Manual web application penetration testing following OWASP WSTG and the OWASP Top 10.
• API security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization.
• SOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool.
• Burp Suite Professional as your primary tool, including extensions and custom payloads.
• Experience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID.
• Multi role and multi account authorization testing methodology.
• External reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling.
• Proven ability to test safely in production, applying rate control, test records and defined stop conditions.
• CVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.
• Strict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met.
• Documentation discipline that records every attempt, successful or not, so results stand up to regulatory review.
• Commitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables.
• Strong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team.

Responsibilities

• Perform outside unauthenticated testing of in scope web applications, REST and SOAP APIs, an API gateway and internet exposed hosts.
• Perform inside testing from client provided accounts, covering cross role and cross account authorization, privilege escalation and access beyond the assigned role.
• Discover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.
• Base every finding on an exploitation attempt and record its result, listing scan only items separately as untested.
• Test all authorized in scope assets, or document the reason for exclusion when client side dependencies are not met.
• Execute all testing without causing service disruption or data loss, escalating stop conditions within one hour.
• Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
• Contribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.
• Support the revalidation report delivered within 60 days of the final report.
• Report weekly status in English and participate in working sessions with the client security team.

Skills

Penetration testing

Web apps testing

API security testing

OWASP WSTG

OWASP Top 10

SSO testing

Burp Suite Pro

OpenAPI/WSDL testing

Regulatory reporting

Evidence reproduction

Education

Bachelor’s Degree in Computer Science, Cybersecurity, Software Engineering

Tools

Burp Suite Pro

SoapUI

Nmap

Amass

Job description

Applaudo is seeking an experienced offensive security professional to perform production-grade penetration testing of web applications, REST/SOAP APIs, and SSO-protected services. The contractor role lasts an initial 2 months with potential extension, requiring strong manual testing and precise evidence collection.

You will work with a U.S.-based security team, document findings with reproducible evidence, and adhere to strict engagement rules while protecting production environments.