Senior Offensive Security Engineer

Rising Tide Digital, Inc.; Taguig; On-site; PHP 700,000 - 1,400,000; Full time

Job summary

Rising Tide Digital, Inc. is seeking an experienced application security professional to execute full-scope pen testing on web apps and APIs, using AI-driven approaches to scale assessments. The role includes validating AI hypotheses and producing reproducible PoCs to demonstrate real risk.

You will collaborate with developers to remediate findings, mentor peers, and help fix systemic security flaws across projects.

Qualifications

• 5+ years in app security/pen testing with deep web app and API focus.
• Experience with OWASP Top 10 and OWASP API Top 10.
• Proficient in Python scripting and building AI workflows for testing.
• Experience with Burp Suite Pro.

Responsibilities

• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.
• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.
• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.
• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.

Skills

Python

AI/LLMs in security testing

Manual testing techniques

HTTP APIs

OWASP Top 10

OWASP API Top 10

OAuth 2.0 / OIDC

IDOR testing

Tools

Burp Suite Pro

Job description

Key Responsibilities

• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.

• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.

• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.

• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.

Qualifications & Requirements

• Experience: 5+ years in app security/pen testing with deep web app and API focus.

• Technical Mastery: OWASP Top 10, OWASP API Top 10, Burp Suite Pro, HTTP/APIs, OAuth 2.0/OIDC, and manual request manipulation.

• Scripting & AI: Python proficiency (required for tooling) plus practical experience integrating AI/LLMs into offensive workflows.

• Nice-to-Haves: Fintech background, cloud white-box testing, or certs (OSWE, GWAPT, BSCP, OSCP).