Senior Offensive Security Engineer (Web & API) - Contract

Applaudo Studios; Ciudad de México; On-site; MXN 1,339,000 - 2,009,000; Part time

Job summary

Applaudo Studios seeks a Senior Offensive Security Engineer (Web & API) for a contractor role. You will conduct controlled exploitation to validate vulnerabilities in production environments, focusing on web apps, REST/SOAP APIs, and SSO-protected services.

2-month contract with potential extension. You bring 5+ years of hands-on testing, strong OWASP-driven methods, and deep Burp Suite expertise. Fluency in English required for reporting and sessions.

Qualifications

• 5+ years of hands on penetration testing experience, including 3+ years on web apps and APIs in production.
• Manual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.
• Experience testing apps protected by SSO (OAuth 2.0, OIDC, SAML).

Responsibilities

• Perform outside unauthenticated testing of in-scope web apps, REST and SOAP APIs, API gateway and internet-exposed hosts.
• Test inside from client-provided accounts, covering cross-role authorization and privilege escalation.
• Score findings with CVSS v3.1 and document reproducible evidence for regulatory review.

Skills

Penetration testing

OWASP WSTG

Burp Suite

SSO testing

API security

Web applications

OpenAPI/Swagger

Education

Bachelor’s degree or equivalent

Tools

Burp Suite Pro

SoapUI

Nmap

Job description

Applaudo Studios seeks a Senior Offensive Security Engineer (Web & API) for a contractor role. You will conduct controlled exploitation to validate vulnerabilities in production environments, focusing on web apps, REST/SOAP APIs, and SSO-protected services.

2-month contract with potential extension. You bring 5+ years of hands-on testing, strong OWASP-driven methods, and deep Burp Suite expertise. Fluency in English required for reporting and sessions.