Senior AI‑Assisted Web & API Penetration Tester

Rising Tide Digital, Inc.; Taguig; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Rising Tide Digital, Inc. is seeking a highly technical Senior Web Application Penetration Testing Engineer to perform deep offensive security testing of complex web apps and APIs.

This hands-on role targets business‑logic flaws, auth bypasses, and multi‑step attack chains using approved offensive AI technologies. You will conduct full‑scope testing, model threats, and produce reproducible PoCs with clear remediation guidance for executive audiences.

Qualifications

• 5+ years of hands‑on app security or penetration testing with web apps and APIs.
• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.
• Demonstrated ability to discover business‑logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners.
• Advanced hands‑on experience with Burp Suite Professional and related offensive‑security tooling.
• Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state.
• Ability to develop scripts or lightweight tooling in Python, JavaScript, PowerShell, Bash, or an equivalent language.
• Demonstrated hands‑on experience using LLMs or AI‑assisted security technologies in offensive‑security workflows.
• Ability to combine AI reasoning with expert manual penetration testing rather than treating AI output as authoritative.
• Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences.

Responsibilities

• Perform full‑scope penetration testing of customer‑facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, APIs, data flows, and critical business workflows.
• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.
• Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business‑logic abuse, injection, API authorization failures, privilege escalation, server‑side validation failures, and multi‑step attack chains.
• Develop reproducible proofs‑of‑concept that clearly demonstrate technical and business impact.
• Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process‑control weaknesses.
• Leverage approved offensive AI technologies and LLM‑based security tooling throughout the penetration‑testing lifecycle.
• Use AI to assist with reconnaissance, attack‑surface analysis, endpoint and API analysis, test‑case generation, vulnerability hypothesis development, and attack‑path identification.
• Independently validate AI‑generated findings and construct reproducible proofs‑of‑concept before reporting them.
• Produce high‑quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.

Skills

AppSec testing

Burp Suite

OWASP knowledge

HTTP/API analysis

AI-assisted security

Scripting (Python/JS/PowerShell)

Manual testing

Technical writing

Tools

Burp Suite Professional

LLM/AI tooling

Job description

Rising Tide Digital, Inc. is seeking a highly technical Senior Web Application Penetration Testing Engineer to perform deep offensive security testing of complex web apps and APIs.

This hands-on role targets business‑logic flaws, auth bypasses, and multi‑step attack chains using approved offensive AI technologies. You will conduct full‑scope testing, model threats, and produce reproducible PoCs with clear remediation guidance for executive audiences.