Lead Penetration Tester – AI & Web Security

Rising Tide Digital Inc; Taguig; In loco; PHP 1.200.000 - 2.400.000; Tempo pieno

Descrizione del lavoro

Rising Tide Digital Inc in the Philippines seeks a Lead Penetration Tester – AI & Web Security to support a U.S. digital bank client. You will lead deep manual testing on core web apps and APIs, using offensive AI tools as force multipliers to expose complex vulnerabilities.

You will validate AI-generated hypotheses, build reproducible PoCs, mentor teammates, and collaborate with developers to remediate systemic flaws.

Competenze

• 5+ years in app security/pen testing focused on web apps and APIs.
• Proficient in OWASP Top 10 / API Top 10.
• Proficient with Burp Suite Pro and manual request manipulation.
• Scripting in Python for tooling and AI workflow integration.
• Nice-to-Haves: Fintech background or security certs.

Mansioni

• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.
• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.
• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.
• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation and mentor team members, fix systemic flaws.

Conoscenze

Penetration testing

API testing

Web security

Python scripting

Threat modeling

Strumenti

Burp Suite Pro

Descrizione del lavoro

• We are seeking a Lead Penetration Tester – AI & Web Security to join an elite team supporting a U.S. digital bank (client). You will lead deep manual penetration testing on core web apps and APIs, using offensive AI tools as force multipliers to expose complex vulnerabilities that scanners miss.


• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.


• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.


• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.


• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation and mentor team members , fix systemic flaws.

Qualifications & Requirements

• Experience: 5+ years in app security/pen testing with deep web app and API focus.


• Technical Mastery: OWASP Top 10, OWASP API Top 10, Burp Suite Pro, HTTP/APIs, OAuth 2.0/OIDC, and manual request manipulation.


• Scripting & AI: Python proficiency (required for tooling) plus practical experience integrating AI/LLMs into offensive workflows.


• Nice-to-Haves: Fintech background, cloud white-box testing, or certs (OSWE, GWAPT, BSCP, OSCP).