Application Security Penetration Tester

DysrupIT Pty; Makati; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

DysrupIT Pty is seeking an Application Penetration Tester to assess web, mobile, and API security. You will plan and run tests, document findings clearly, and help engineers fix issues before attackers exploit them.

You’ll work on engagements for Australian clients, bringing strong data protection and cyber compliance knowledge to the table. Ideal candidates have hands‑on testing experience, deep OWASP expertise, and proficiency with Burp Suite and related tools, plus scripting and

Qualifications

• 3–5+ years of hands‑on application penetration testing experience.
• Strong knowledge of the OWASP Top 10, OWASP ASVS, and OWASP API Security Top 10.
• Proficiency with Burp Suite and common testing tools (e.g., Nmap, SQLmap, Postman, Frida, MobSF).
• Working knowledge of authentication and authorization standards (OAuth 2.0, OIDC, JWT, SAML).
• Scripting ability in Python, Bash, or similar.
• Understanding of cloud environments (AWS, Azure, or GCP) and how they affect application security.
• Strong written English and report‑writing skills.
• Ability to work independently and meet engagement deadlines.

Responsibilities

• Plan and carry out penetration tests on web applications, APIs, and mobile apps (black-box, grey-box, and white-box).
• Find and safely exploit vulnerabilities such as injection flaws, broken authentication and access control, business logic flaws, and insecure configurations.
• Perform manual testing alongside automated scanning, and validate results to remove false positives.
• Write clear, accurate reports with risk ratings, proof of concept, business impact, and practical remediation steps.
• Present findings to technical and non-technical stakeholders.
• Retest fixes and confirm that issues are closed.
• Map findings to relevant standards and client compliance obligations.
• Support secure code review and threat modelling where needed.
• Keep up with new attack techniques, tools, and vulnerabilities.

Skills

Penetration testing

Web app testing

Mobile app testing

API security testing

Strong written English

Independent work

Tools

Burp Suite

Nmap

SQLmap

Postman

Frida

MobSF

OAuth 2.0

OIDC

JWT

SAML

Job description

DysrupIT Pty is seeking an Application Penetration Tester to assess web, mobile, and API security. You will plan and run tests, document findings clearly, and help engineers fix issues before attackers exploit them.

You’ll work on engagements for Australian clients, bringing strong data protection and cyber compliance knowledge to the table. Ideal candidates have hands‑on testing experience, deep OWASP expertise, and proficiency with Burp Suite and related tools, plus scripting and