Lead Penetration Tester AI & Web Security

rising tide digital inc; Taguig; À distance; PHP 1 200 000 - 2 000 000; Plein temps

Résumé du poste

Rising Tide Digital Inc. is seeking a Lead Penetration Tester – AI & Web Security to join a U.S. digital bank project. You will lead deep manual testing on core web apps and APIs, applying offensive AI tools to reveal complex vulnerabilities that scanners miss.

Responsibilities include guiding remediation with developers, mentoring teammates, and shaping secure development practices while advancing offensive security capabilities with Python tooling and AI workflows.

Qualifications

• 5+ years in app security/pen testing with web apps and APIs.
• Knowledge of OWASP Top 10 and API Top 10.
• Experience integrating AI/LLMs into offensive workflows.

Responsabilités

• Manual Pen Testing: test web apps/APIs to exploit flaws.
• Offensive AI & Automation: build Python tooling and AI workflows.
• Validation & PoCs: verify AI hypotheses and produce proofs of concept.
• Remediation & Mentorship: work with developers and mentor team.

Connaissances

5+ years in app security/pen testing

Deep web app & API focus

Python proficiency

Formation

OSWE

GWAPT

OSCP

Outils

Burp Suite Pro

HTTP/APIs

OAuth 2.0/OIDC

Description du poste

Job Overview

• We are seeking a Lead Penetration Tester – AI & Web Security to join an elite team supporting a U.S. digital bank (client). You will lead deep manual penetration testing on core web apps and APIs, using offensive AI tools as force multipliers to expose complex vulnerabilities that scanners miss.

Key Responsibilities

• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.
• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python s and AI workflows to scale testing depth.
• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.
• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.

Qualifications & Requirements

• Experience: 5+ years in app security/pen testing with deep web app and API focus.
• Technical Mastery: OWASP Top 10, OWASP API Top 10, Burp Suite Pro, HTTP/APIs, OAuth 2.0/OIDC, and manual request manipulation.
• ing & AI: Python proficiency (required for tooling) plus practical experience integrating AI/LLMs into offensive workflows.
• Nice-to-Haves: Fintech background, cloud white-box testing, or certs (OSWE, GWAPT, BSCP, OSCP).