Senior Offensive Security Engineer - AI-Driven Web & API

Recruitday Inc.; Taguig; On-site; PHP 1,800,000 - 2,600,000; Full time

Job summary

Recruitday Inc. seeks a Senior Offensive Security Engineer to join a confidential U.S.-based financial client team. You will perform deep manual testing of web apps and APIs, amplified by AI tools, and validate AI-generated hypotheses with reproducible PoCs.

You will conduct threat modeling, test with multiple identities and roles, and deliver high-quality reports with remediation guidance. This is a full-time role with a focus on advanced exploitation techniques and AI-augmented workflows.

Qualifications

• 5+ years of hands-on application security or penetration-testing experience.
• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.
• Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis.
• Advanced hands-on experience with Burp Suite Professional and related tooling.
• Strong knowledge of OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state.
• Ability to develop lightweight tooling in Python (strongly preferred).
• Strong technical writing and communication skills.
• Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows.

Responsibilities

• Perform full-scope penetration testing of customer-facing and internal web applications and APIs.
• Conduct threat modeling and analyze architecture, trust boundaries, authentication, authorization, data flows, and business workflows.
• Perform deep manual security testing beyond automated scanners.
• Identify and exploit complex vulnerabilities including broken access control and API authorization failures.
• Test with multiple identities, roles, and workflow states to expose weaknesses.
• Develop reproducible proofs-of-concept demonstrating impact.

Skills

Web pentesting

API testing

Manual testing

OWASP knowledge

AI-assisted testing

Python scripting

Security reporting

Technical writing

Communication

Tools

Burp Suite

Python

Job description

Recruitday Inc. seeks a Senior Offensive Security Engineer to join a confidential U.S.-based financial client team. You will perform deep manual testing of web apps and APIs, amplified by AI tools, and validate AI-generated hypotheses with reproducible PoCs.

You will conduct threat modeling, test with multiple identities and roles, and deliver high-quality reports with remediation guidance. This is a full-time role with a focus on advanced exploitation techniques and AI-augmented workflows.