Senior Penetration Tester - Web, API & Cloud Security

Haumaru Whānau; Auckland; On-site; NZD 120,000 - 180,000; Full time

Job summary

Haumaru Technologies Limited is seeking a skilled Penetration Tester to deliver CREST-aligned security testing across web applications, APIs, mobile platforms, and cloud environments. The role focuses on real-world attack simulations, deep technical testing, and high-impact vulnerability discovery for enterprise and government clients.

You will work closely with security architects, developers, and clients to deliver high-quality CREST-grade reports, actionable remediation guidance, and

Qualifications

• Proven experience in penetration testing or offensive security.
• Strong hands-on experience in web and API penetration testing.
• Deep understanding of OWASP Top 10 & API Top 10.
• Authentication and session management vulnerabilities.
• Access control flaws (IDOR, privilege escalation, RBAC bypass).
• Proficiency with Burp Suite (advanced usage).
• Experience with mobile testing tools (MobSF, Frida, Objection).
• Cloud security fundamentals (Azure/AWS/GCP).
• CI/CD and DevSecOps familiarity.
• Ability to write clear penetration testing reports.
• Strong problem-solving and analytical skills.

Responsibilities

• Perform penetration testing on web applications, APIs, and cloud environments.
• Identify, exploit, and validate vulnerabilities across OWASP Top 10 and API Top 10.
• Conduct manual testing and exploitation, avoiding over-reliance on automated tools.
• Test authentication, authorization, and access control including privilege escalation and IDOR scenarios.
• Chain vulnerabilities to simulate real-world attack paths and business logic abuse.
• Conduct secure configuration reviews and cloud misconfiguration assessments.
• Document findings with clear technical detail, risk impact, CVSS scoring, and remediation guidance.
• Collaborate with clients and internal teams to explain findings and provide practical remediation support.
• Stay up-to-date with emerging threats, exploits, and offensive security techniques.

Skills

Penetration testing

Offensive security

Web testing

API testing

OWASP Top 10

Authentication flaws

Access control

RBAC bypass

Burp Suite

MobSF

Frida

Objection

Tools

Burp Suite

MobSF

Frida

Objection

Azure

AWS

GCP

Job description

Haumaru Technologies Limited is seeking a skilled Penetration Tester to deliver CREST-aligned security testing across web applications, APIs, mobile platforms, and cloud environments. The role focuses on real-world attack simulations, deep technical testing, and high-impact vulnerability discovery for enterprise and government clients.

You will work closely with security architects, developers, and clients to deliver high-quality CREST-grade reports, actionable remediation guidance, and