Senior Offensive Security Engineer - IT Banking

Rising Tide Digital, Inc.; Taguig; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Rising Tide Digital, Inc. seeks an experienced security professional to lead hands-on offensive testing across web apps and APIs. You will combine traditional pen testing with AI-assisted tooling, validate hypotheses, and deliver reproducible proofs of risk while mentoring teammates.

This role requires deep OWASP knowledge, Python scripting, and experience integrating AI/LLMs into offensive workflows. You will collaborate with developers to remediate flaws and strengthen security across product

Qualifications

• 5+ years in app security/pen testing with web app and API focus
• Deep knowledge of OWASP Top 10 and API Top 10
• Proficient in Python for tooling
• Experience integrating AI/LLMs into offensive workflows
• Nice-to-haves: OSWE, GWAPT, OSCP

Responsibilities

• Manual Pen Testing: full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.
• Offensive AI & Automation: use LLMs for recon, threat modeling, and test generation; build Python scripts to scale testing depth.
• Validation & PoCs: validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.
• Remediation & Mentorship: partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.

Skills

5+ years in app security/pen testing

Deep web app/API focus

Python proficiency

AI & LLM integration

Manual testing

Tools

Burp Suite Pro

HTTP/APIs

OAuth 2.0/OIDC

Job description

Key Responsibilities

• Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.

• Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.

• Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.

• Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.

Qualifications & Requirements

• Experience: 5+ years in app security/pen testing with deep web app and API focus.

• Technical Mastery: OWASP Top 10, OWASP API Top 10, Burp Suite Pro, HTTP/APIs, OAuth 2.0/OIDC, and manual request manipulation.

• Scripting & AI: Python proficiency (required for tooling) plus practical experience integrating AI/LLMs into offensive workflows.

• Nice-to-Haves: Fintech background, cloud white-box testing, or certs (OSWE, GWAPT, BSCP, OSCP).