Security Engineer (Burp Suite )

Hrtx; Taguig; On-site; PHP 800,000 - 1,200,000; Full time

Job summary

A leading cybersecurity firm is seeking a skilled Web & API Security Engineer to perform security testing on modern web applications and APIs in Metro Manila. The role requires proficiency in identifying vulnerabilities and simulating real-world attacks. The ideal candidate has proven experience in penetration testing and can think like an attacker to uncover hidden risks. You will work closely with engineering teams to enhance the security of our platforms.

Qualifications

• Proven experience in penetration testing of web apps and APIs.
• Expertise in AuthN/AuthZ vulnerabilities (OAuth, IDOR, BOLA, SSO bypass).
• Familiarity with API attack methods (replay attacks, schema issues, parameter pollution).

Responsibilities

• Perform manual security testing on web applications and APIs.
• Identify vulnerabilities such as logic flaws and authentication bypasses.
• Simulate real-world attacks and design potential attack paths.

Skills

Penetration testing

OAuth vulnerabilities

API attack methods

Burp Suite Pro

Scripting (Python/Bash)

Tools

Burp Suite Pro

Postman

sqlmap

jwt_tool

Job description

About the job Security Engineer (Burp Suite )

About the Role
We are looking for a skilled Web & API Security Engineer with strong offensive security expertise. In this hands-on role, you will test modern web applications and APIs to find vulnerabilities, simulate real-world attacks, and work with engineering teams to improve our platforms security.

What Youll Do

• Perform manual security testing on web applications and APIs (REST, GraphQL, gRPC).
• Identify vulnerabilities such as logic flaws, authentication bypasses, and chained exploits.
• Simulate real-world attacks and design potential attack paths.
• Test and analyze security controls like WAFs, rate limits, and authentication systems.
• Document findings clearly to help engineers fix issues quickly.
• Explore edge cases and scenarios often missed by automated tools.

What Were Looking For

• Proven experience in penetration testing of web apps and APIs.
• Expertise in AuthN/AuthZ vulnerabilities (OAuth, IDOR, BOLA, SSO bypass).
• Familiarity with API attack methods (replay attacks, schema issues, parameter pollution).
• Proficiency with tools like Burp Suite Pro, Postman, sqlmap, jwt_tool, and scripting (Python/Bash).
• Ability to think like an attacker and uncover hidden risks.