Senior Web Application Penetration Testing Engineer

Computrabajo; Naucalpan de Juárez; Remote; MXN 900,000 - 1,500,000; Full time

Benefits offered by this job

Remote position

Excellent corporate environment

Growth opportunities

Job summary

Crowe Global member firm in Mexico is seeking a Senior Web Application Penetration Testing Engineer & Offensive AI to lead deep manual testing of web apps and APIs.

You will leverage Burp Suite, Python scripts, and AI-assisted workflows to detect vulnerabilities, craft proofs of concept, and help remediation.

This remote role offers a competitive salary and growth with a top-tier global firm.

Qualifications

• 5+ years of hands-on experience in application security or penetration testing.
• Strong understanding of HTTP, REST APIs, authentication, authorization, session management, and common web security vulnerabilities.
• Manual penetration testing beyond automated scanners and standard vulnerability checks.
• Knowledge of the OWASP Web Security Testing Guide and common risks.
• Hands-on experience using Burp Suite or equivalent tools.
• Experience writing or modifying Python scripts for security testing or automation.
• Ability to validate vulnerabilities, develop proofs of concept, and communicate findings effectively.

Responsibilities

• Perform in-depth manual penetration testing of web applications, REST APIs, and supporting services.
• Identify and validate complex vulnerabilities, including broken access control, authentication weaknesses, business logic flaws, injection, and privilege escalation.
• Analyze architecture, authentication mechanisms, authorization models, and data flows to identify exploitable weaknesses.
• Use Burp Suite and other security testing tools to manipulate requests, validate findings, and develop reproducible proofs of concept.
• Leverage AI and LLM-based tools to support reconnaissance, vulnerability analysis, test case generation, and attack path identification.
• Develop and improve Python scripts, prompts, agents, and API integrations to automate repetitive testing tasks and enhance security assessment workflows.
• Document findings clearly, communicate technical and business impact, and recommend remediation strategies.

Skills

Penetration testing

Web security

Python scripting

AI-assisted security

REST APIs

Security automation

Team leadership

Tools

Burp Suite

Job description

About us

Our professional firm boasts over 70 years of experience and is ranked 5th nationally and 9th globally as part of Crowe Global, a network of over 769 offices in 129 countries worldwide. Our prestige, with 19 offices in Mexico, is built on experience, reputation, and the quality of our Audit, Tax, and Consulting solutions, among others. We provide the best advice so our clients can make smart decisions!

Join our team as: Senior Web Application Penetration Testing Engineer & Offensive AI

What are we looking for?

We are seeking a senior security professional with strong hands- on expertise in web application and API penetration testing, combined with AI-assisted security automation. The ideal candidate can identify and validate complex vulnerabilities trough deep manual testing and leverage Python and AI-driven tools to improve testing efficiency, coverage, and accuracy.

Key Responsabilities

• Perform in – depth manual penetration testing testing of web applications, REST APIs, and supporting services.
• Identify and validate complex vulnerabilities, including broken access control, authentication weaknesses, business logic flaws, injection, and privilege escalation.
• Analyze application architecture, authentication mechanisms, authorization models, and data flows to identify exploitable security weaknesses.
• Use Burp Suite and other security testing tools to manipulate requests, validate findings, and develop reproducible proofs of concept.
• Leverage approved AI and LLM-based tools to support reconnaissance, vulnerability analysis, test case generation, and attack path identification.
• Develop and improve Python scripts, prompts, agents, and API integrations to automate repetitive testing tasks and enhace security assessment workflows.
• Document findings clearly, communicate technical and business impact, and recommend remediation strategies.

Requiered qualifications

• 5+ years of hands- on experience in application security or penetration testing, including substantial web application ad API testing.
• Strong understanding of HTTP, REST APIs, authentication, authotization, session management, and common web security vulnerabilities.
• Practical experience performing manual penetration testing beyond automated scanners and standard vulnerability checks.
• Strong knowledge of the OWASP Web Security Testing Guide and common application security risks.
• Hands-on experience using Burp Suite or equivalent web application security testing tools.
• Experience writing or modifying Python scripts for security testing or automation.
• Abillity to validate vulnerabilities, develop proofs of concept, and communicate technical findings effectively.

Preferred Qualifications

• Experience using AI-assisted security testing tools, LLM-based security workflows, or offensive security agents.
• Experience developing reusable prompts, automation scripts, or API integrations for penetration testing.

What do we expect from you?

• We are looking for a detailed- oriented, analytical professional with strong problem-solving skills and hands- on approach security testing
• Strong leadership, communication, and team development skills.

What do we offer?

• Attractive and competitive salary, determined based on the candidate's experience and executive skills and benefits
• Remote position
• Job stability and an excellent corporate work environment.
• Growth opportunity and career plan continue within a top-tier global firm.