Senior Offensive Security Engineer

Recruitday Inc.; Taguig; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Recruitday Inc. is seeking a Senior Offensive Security Engineer in the Philippines to perform deep manual testing of web applications and APIs, amplified by approved offensive AI technologies.

The role emphasizes independent validation of AI-generated hypotheses and reproducible exploits to demonstrate significant findings. You will conduct threat modeling, test across multiple identities and workflows, and produce high-quality remediation-focused reports in a fast-paced, security-first

Qualifications

• 5+ years of hands-on application security or penetration-testing experience.
• Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis.
• Advanced hands-on experience with Burp Suite Pro and related offensive-security tooling.
• Strong knowledge of the OWASP WSTG, OWASP Top 10, and OWASP API Security Top 10.

Responsibilities

• Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze architecture, trust boundaries, authentication, authorization, data flows, and business workflows.
• Perform deep manual security testing beyond automated scanners.
• Identify and exploit complex vulnerabilities and demonstrate reproducible, exploitable findings.
• Test with multiple identities, roles, and workflow states to expose weaknesses.
• Develop reproducible proofs-of-concept and clearly communicate impact.

Skills

Application security

Penetration testing

Manual testing

Security writing & communication

AI-assisted security

Tools

Burp Suite Professional

Python scripting

Job description

This position supports a confidential client, a U.S.-based digital financial institution. The successful candidate will be assigned full-time to the client’s cybersecurity organization. The client is building an AI-native security organization that moves at the speed of the business. Our customer-facing and internal web applications and APIs carry financial data, customer information, and transaction workflows where subtle authorization and business-logic flaws have real consequences. We are looking for a Senior Offensive Security Engineer who will perform deep manual testing of these applications, amplified by approved offensive AI technologies.

Role mandate:

use elite manual web and API penetration-testing expertise, amplified by approved offensive AI technologies, to discover, validate, and clearly communicate exploitable vulnerabilities that conventional testing misses.

This is not a scan-and-report role. AI does not replace hands‑on exploitation: you will independently validate every AI-generated hypothesis, eliminate false positives, and demonstrate that significant findings are reproducible and exploitable.

Responsibilities

• Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, data flows, and critical business workflows.
• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.
• Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business‑logic abuse, injection, API authorization failures, privilege escalation, server‑side validation failures, and multi‑step attack chains.
• Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process‑control weaknesses.
• Develop reproducible proofs‑of‑concept that clearly demonstrate technical and business impact, and distinguish exploitable issues from scanner noise, environmental artifacts, and low‑value findings.

Offensive AI & AI‑Assisted Testing

• Leverage approved offensive AI technologies and LLM‑based security tooling throughout the penetration‑testing lifecycle: reconnaissance, attack‑surface analysis, endpoint and API analysis, test‑case generation, vulnerability hypothesis development, and attack‑path identification.
• Apply AI‑assisted analysis to identify unusual behavior, authorization inconsistencies, business‑logic weaknesses, and potential multi‑step exploitation paths.
• Use AI to prioritize high‑value targets and testing scenarios so expert effort is concentrated where meaningful findings are most likely.
• Combine AI‑generated hypotheses with expert manual analysis using Burp Suite Professional and custom testing utilities, and independently validate every AI‑generated finding with a reproducible proof‑of‑concept before reporting it.
• Use AI to correlate findings across applications and identify recurring vulnerability patterns or systemic weaknesses.
• Develop reusable prompts, Python scripts, agents, API integrations, and workflows that increase testing speed, consistency, depth, and coverage.
• Document AI‑assisted testing sufficiently to establish repeatability, material human oversight, and the basis for significant conclusions.

Reporting, Remediation & Program Improvement

• Produce high‑quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.
• Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting.
• Identify recurring vulnerability patterns and architectural weaknesses across applications and recommend systemic corrective actions.
• Improve penetration‑testing methodology, tooling, reporting standards, and test coverage.
• Lead technical knowledge‑sharing sessions and provide peer review and mentoring on advanced exploitation techniques and finding quality.
• Operate within authorized scope, rules of engagement, data‑handling requirements, and approved AI usage controls.

Qualifications

Required

• 5+ years of hands‑on application security or penetration‑testing experience, with substantial experience testing web applications and APIs.
• Demonstrated ability to discover business‑logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners.
• Advanced hands‑on experience with Burp Suite Professional and related offensive‑security tooling.
• Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences.
• Demonstrated hands‑on experience using LLMs or AI‑assisted security technologies in offensive‑security workflows, combining AI reasoning with expert manual testing rather than treating AI output as authoritative.
• Experience building or modifying Python‑based security automation, API integrations, prompt workflows, or agentic testing capabilities, with practical prompt‑engineering and context‑engineering skills for security analysis.
• Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses, and the ability to validate AI‑generated findings through manual testing and reproducible proofs‑of‑concept.
• Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.

Preferred

• Experience performing penetration testing in financial services or another regulated industry, including complex transactional applications where authorization or business‑logic failures can affect financial data, customer information, or transaction integrity.
• Experience testing cloud‑native, API‑heavy, microservices, and modern identity‑based architectures.
• Experience with source‑assisted or white‑box penetration testing and secure code review.
• Familiarity with CI/CD pipelines, DevSecOps practices, and modern software‑development environments.
• Hands‑on certifications such as OSWE, GWAPT, BSCP, OSCP, or an equivalent demonstration of advanced capability.

Why This Role

• You will build, not just govern. This team ships security tooling and automation, not slide decks.
• AI‑first security organization: our autonomous SOC pipeline is live and you will extend AI‑driven automation into offensive application security.
• Direct impact at a regulated U.S. financial institution where application vulnerabilities are consequential and visible to leadership.
• We are not looking for someone who simply runs a scanner or feeds application output into an LLM. We want an elite hands‑on web penetration tester who uses AI as a force multiplier while independently validating every material conclusion.
• Work alongside senior practitioners who value intellectual honesty, hands‑on craft, and enforceable security over compliance theater.