Senior Offensive Security Engineer

recruitday; Taguig; On-site; PHP 1,800,000 - 2,600,000; Full time

Job summary

Recruitday Inc. seeks a Senior Offensive Security Engineer to join a confidential U.S.-based financial client team. You will perform deep manual testing of web apps and APIs, amplified by AI tools, and validate AI-generated hypotheses with reproducible PoCs.

You will conduct threat modeling, test with multiple identities and roles, and deliver high-quality reports with remediation guidance. This is a full-time role with a focus on advanced exploitation techniques and AI-augmented workflows.

Qualifications

• 5+ years of hands-on application security or penetration-testing experience.
• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.
• Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis.
• Advanced hands-on experience with Burp Suite Professional and related tooling.
• Strong knowledge of OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state.
• Ability to develop lightweight tooling in Python (strongly preferred).
• Strong technical writing and communication skills.
• Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows.

Responsibilities

• Perform full-scope penetration testing of customer-facing and internal web applications and APIs.
• Conduct threat modeling and analyze architecture, trust boundaries, authentication, authorization, data flows, and business workflows.
• Perform deep manual security testing beyond automated scanners.
• Identify and exploit complex vulnerabilities including broken access control and API authorization failures.
• Test with multiple identities, roles, and workflow states to expose weaknesses.
• Develop reproducible proofs-of-concept demonstrating impact.

Skills

Web pentesting

API testing

Manual testing

OWASP knowledge

AI-assisted testing

Python scripting

Security reporting

Technical writing

Communication

Tools

Burp Suite

Python

Job description

Senior Offensive Security Engineer

Overview

This position supports a confidential client, a U.S.-based digital financial institution. The successful candidate will be assigned full-time to the client’s cybersecurity organization. The client is building an AI-native security organization that moves at the speed of the business. Our customer-facing and internal web applications and APIs carry financial data, customer information, and transaction workflows where subtle authorization and business-logic flaws have real consequences. We are looking for a Senior Offensive Security Engineer who will perform deep manual testing of these applications, amplified by approved offensive AI technologies.

Role mandate

use elite manual web and API penetration-testing expertise, amplified by approved offensive AI technologies, to discover, validate, and clearly communicate exploitable vulnerabilities that conventional testing misses.

This is not a scan-and-report role. AI does not replace hands-on exploitation: you will independently validate every AI-generated hypothesis, eliminate false positives, and demonstrate that significant findings are reproducible and exploitable.

Responsibilities

Web Application & API Penetration Testing

• Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, data flows, and critical business workflows.
• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.
• Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business-logic abuse, injection, API authorization failures, privilege escalation, server-side validation failures, and multi-step attack chains.
• Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process-control weaknesses.
• Develop reproducible proofs-of-concept that clearly demonstrate technical and business impact, and distinguish exploitable issues from scanner noise, environmental artifacts, and low-value findings.

Offensive AI & AI-Assisted Testing

• Leverage approved offensive AI technologies and LLM-based security tooling throughout the penetration-testing lifecycle: reconnaissance, attack-surface analysis, endpoint and API analysis, test-case generation, vulnerability hypothesis development, and attack-path identification.
• Apply AI-assisted analysis to identify unusual behavior, authorization inconsistencies, business-logic weaknesses, and potential multi-step exploitation paths.
• Use AI to prioritize high-value targets and testing scenarios so expert effort is concentrated where meaningful findings are most likely.
• Combine AI-generated hypotheses with expert manual analysis using Burp Suite Professional and custom testing utilities, and independently validate every AI-generated finding with a reproducible proof-of-concept before reporting it.
• Use AI to correlate findings across applications and identify recurring vulnerability patterns or systemic weaknesses.
• Develop reusable prompts, Python s, agents, API integrations, and workflows that increase testing speed, consistency, depth, and coverage.
• Document AI-assisted testing sufficiently to establish repeatability, material human oversight, and the basis for significant conclusions.

Reporting, Remediation & Program Improvement

• Produce high-quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.
• Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting.
• Identify recurring vulnerability patterns and architectural weaknesses across applications and recommend systemic corrective actions.
• Improve penetration-testing methodology, tooling, reporting standards, and test coverage.
• Lead technical knowledge-sharing sessions and provide peer review and mentoring on advanced exploitation techniques and finding quality.
• Operate within authorized scope, rules of engagement, data-handling requirements, and approved AI usage controls.

Qualifications

Required

• 5+ years of hands-on application security or penetration-testing experience, with substantial experience testing web applications and APIs.
• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.
• Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners.
• Advanced hands-on experience with Burp Suite Professional and related offensive-security tooling.
• Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state.
• Ability to develop s or lightweight tooling in Python (strongly preferred), Java , Bash, or an equivalent language.
• Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences.
• Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows, combining AI reasoning with expert manual testing rather than treating AI output as authoritative.
• Experience building or modifying Python-based security automation, API integrations, prompt workflows, or agentic testing capabilities, with practical prompt-engineering and context-engineering skills for security analysis.
• Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses, and the ability to validate AI-generated findings through manual testing and reproducible proofs-of-concept.
• Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.

Preferred

• Experience performing penetration testing in financial services or another regulated industry, including complex transactional applications where authorization or business-logic failures can affect financial data, customer information, or transaction integrity.
• Experience testing cloud-native, API-heavy, microservices, and modern identity-based architectures.
• Experience with source-assisted or white-box penetration testing and secure code review.
• Familiarity with CI/CD pipelines, DevSecOps practices, and modern software-development environments.
• Hands-on certifications such as OSWE, GWAPT, BSCP, OSCP, or an equivalent demonstration of advanced capability.

Why This Role

• You will build, not just govern. This team ships security tooling and automation, not slide decks.
• AI-first security organization: our autonomous SOC pipeline is live and you will extend AI-driven automation into offensive application security.
• Direct impact at a regulated U.S. financial institution where application vulnerabilities are consequential and visible to leadership.
• We are not looking for someone who simply runs a scanner or feeds application output into an LLM. We want an elite hands-on web penetration tester who uses AI as a force multiplier while independently validating every material conclusion.
• Work alongside senior practitioners who value intellectual honesty, hands-on craft, and enforceable security over compliance theater.