Lead Web App Penetration Tester - AI-Driven Security (Remote)

Crowe México; Naucalpan de Juárez; Remote; MXN 800,000 - 1,100,000; Full time

Benefits offered by this job

Remote position

Job summary

Crowe México is seeking a Senior Web Application Penetration Testing Engineer with expertise in web apps, APIs, and AI-assisted security automation. The role emphasizes manual testing, strong problem solving, and clear communication of risk to stakeholders.

Remote position available, with a focus on Mexico-based clients. 5+ years of hands-on experience and Python scripting are highly valued, along with a strong grasp of OWASP guidelines and security best practices.

Qualifications

• 5+ years of hands-on experience in application security or penetration testing.
• Strong understanding of HTTP, REST APIs and common web vulnerabilities.
• Experience beyond automated scanners with manual testing.
• Familiarity with OWASP WSTG and security risks.
• Hands-on Python scripting for testing or automation.
• Ability to validate findings and communicate clearly.

Responsibilities

• Perform in-depth manual penetration testing of web apps and REST APIs.
• Identify and validate complex vulnerabilities including auth flaws and logic errors.
• Analyze architecture, auth models, and data flows for weaknesses.
• Use Burp Suite and other tools to reproduce findings with PoCs.
• Leverage AI-assisted tools to support reconnaissance and test case generation.
• Develop Python scripts and integrations to automate tasks and workflows.
• Document findings with business impact and remediation guidance.

Skills

Web app security

API testing

Python scripting

Security automation

Analytical thinking

Tools

Burp Suite

Job description

Crowe México is seeking a Senior Web Application Penetration Testing Engineer with expertise in web apps, APIs, and AI-assisted security automation. The role emphasizes manual testing, strong problem solving, and clear communication of risk to stakeholders.

Remote position available, with a focus on Mexico-based clients. 5+ years of hands-on experience and Python scripting are highly valued, along with a strong grasp of OWASP guidelines and security best practices.