Offensive Security

Nuvnext; Región Centro; Hybrid; MXN 420,000 - 660,000; Full time

Job summary

Nuvnext in Guadalajara, Mexico, is seeking a security-focused penetration tester to perform authorized assessments on web applications and APIs. You will evaluate agents for prompt injection and tool abuse, review access policies and secrets, and document each finding with evidence to ensure proper closure.

This on-site, full-time role places you at the core of product security, collaborating directly with founders and production teams.

Qualifications

• Found real vulnerabilities in professional work, CTFs, or bug bounty programs.
• Understand web applications, authentication and access control.
• Work only within what is authorized and document it.

Responsibilities

• Run authorized penetration tests on applications and APIs.
• Test agents against prompt injection and tool abuse.
• Review access policies, secrets and exposed data.
• Document every finding with evidence and verify it gets closed.

Skills

Web security concepts

Authentication

Access control

Education

OSCP or equivalent

Tools

PostgreSQL

Job description

Engineering Guadalajara · in person Full time Security

We have access to our clients' operations. You try to break the platform, the agents and the projects before anyone else tries, and close every finding with evidence.

The role

• Run authorized penetration tests on applications and APIs.
• Test agents against prompt injection and tool abuse.
• Review access policies, secrets and exposed data.
• Document every finding with evidence and verify it gets closed.

Your first 90 days

• Day 30

  You learn the security standard and run your first authorized test.

• Day 60

  You test a complete project and close findings with the team.

• Day 90

  Tests against the agents run before every major change.

Must have

• You have found real vulnerabilities, at work, in CTFs or in bug bounty programs.
• You understand web applications, authentication and access control.
• You work only within what is authorized and you document it.
• You can explain a risk to the person who decides.

Nice to have

• Postgres and row-level policies.
• OSCP or equivalent.

What working here is like

What you build goes into products that operate real organizations. You work directly with the founders, with no layers between your code and production, under the same rule we give the intelligence: a person signs what is critical.