Senior Web Application Penetration Test Engineer

Rising Tide Digital Inc; Taguig; On-site; PHP 1,800,000 - 3,200,000; Full time

Job summary

Rising Tide Digital Inc in Taguig, Philippines seeks a highly technical Senior Web Application Penetration Testing Engineer to perform deep offensive security testing of complex web applications and APIs. This hands-on role focuses on identifying business-logic flaws, authorization bypasses, and multi-step attack chains.

You will leverage AI-assisted testing alongside Burp Suite Pro and custom tooling, validate AI-generated hypotheses, and develop reproducible proofs of concept.

Qualifications

• 5+ years of hands-on application security or pentesting experience.
• Proven ability to find business-logic and authorization flaws through manual analysis.
• Advanced hands-on use of Burp Suite Professional and related tooling.
• Strong knowledge of OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Excellent technical writing and ability to explain complex exploitation paths to diverse audiences.

Responsibilities

• Perform full-scope penetration testing of web apps, APIs, and supporting services.
• Conduct threat modeling and analyze architecture, trust boundaries, auth models, and data flows.
• Perform deep manual security testing beyond standard scanners and checklists.
• Develop reproducible proofs-of-concept showing technical and business impact.
• Test with multiple identities, roles, and workflow states to reveal authorization weaknesses.
• Document findings and work with engineering teams to remediate and retest.

Skills

Hands-on security testing

Technical writing

Cross-functional communication

Threat modeling

Education

OSWE/GWAPT/OSCP/BSCP certifications

Tools

Burp Suite Professional

Python scripting

Job description

We are seeking a highly technical Senior Web Application Penetration Testing Engineer to perform deep offensive security testing of complex web applications and APIs. This is a hands‑on role focused on identifying vulnerabilities that conventional automated testing frequently misses, including business‑logic flaws, authorization bypasses, privilege escalation paths, API abuse, and multi‑step attack chains.

A major component of the role is the practical use of approved offensive AI technologies to augment penetration testing. The engineer will apply AI‑assisted techniques to accelerate reconnaissance and application analysis, develop and prioritize vulnerability hypotheses, identify promising attack paths, correlate findings, and improve the depth and coverage of expert‑led manual testing.

The engineer must independently validate AI‑generated hypotheses, eliminate false positives, and demonstrate that significant findings are reproducible and exploitable.

Key Responsibilities:

• Perform full‑scope penetration testing of customer‑facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, APIs, data flows, and critical business workflows.
• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.
• Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business‑logic abuse, injection, API authorization failures, privilege escalation, server‑side validation failures, and multi‑step attack chains.
• Develop reproducible proofs‑of‑concept that clearly demonstrate technical and business impact.
• Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process‑control weaknesses.
• Distinguish exploitable security issues from scanner noise, environmental artifacts, and low‑value findings.

Offensive AI & AI‑Assisted Testing

• Leverage approved offensive AI technologies and LLM‑based security tooling throughout the penetration‑testing lifecycle.
• Use AI to assist with reconnaissance, attack‑surface analysis, endpoint and API analysis, test‑case generation, vulnerability hypothesis development, and attack‑path identification.
• Apply AI‑assisted analysis to identify unusual behavior, authorization inconsistencies, business‑logic weaknesses, and potential multi‑step exploitation paths.
• Use AI to prioritize high‑value targets and testing scenarios so expert effort is concentrated on areas most likely to yield meaningful findings.
• Combine AI‑generated hypotheses with expert manual analysis using Burp Suite Professional and custom testing utilities.
• Independently validate AI‑generated findings and construct reproducible proofs‑of‑concept before reporting them.
• Use AI to correlate findings across applications and identify recurring vulnerability patterns or systemic weaknesses.
• Develop reusable prompts, Python scripts, agents, API integrations, or workflows that increase testing speed, consistency, depth, and coverage.
• Document AI‑assisted testing sufficiently to establish repeatability, material human oversight, and the basis for significant conclusions.

Reporting, Remediation & Program Improvement

• Produce high‑quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.
• Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting.
• Identify recurring vulnerability patterns and architectural weaknesses across applications and recommend systemic corrective actions.
• Improve penetration‑testing methodology, tooling, reporting standards, and test coverage.
• Lead technical knowledge‑sharing sessions and provide thoughtful peer review or mentoring on advanced exploitation techniques and finding quality.
• Operate within authorized scope, rules of engagement, data‑handling requirements, and approved AI usage controls.

Required Qualifications

• 5+ years of hands‑on application security or penetration‑testing experience, with substantial experience testing web applications and APIs.
• Demonstrated ability to discover business‑logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners.
• Advanced hands‑on experience with Burp Suite Professional and related offensive‑security tooling.
• Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.
• Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences.

Required Offensive AI Experience

• Demonstrated hands‑on experience using LLMs or AI‑assisted security technologies in offensive‑security workflows.
• Ability to combine AI reasoning with expert manual penetration testing rather than treating AI output as authoritative.
• Experience building or modifying Python‑based security automation, API integrations, prompt workflows, or agentic testing capabilities.
• Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses.
• Ability to independently validate AI‑generated vulnerabilities through manual testing and reproducible proofs‑of‑concept.
• Practical prompt‑engineering and context‑engineering skills for security analysis.
• Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.

Preferred Qualifications

• Experience performing penetration testing in financial services or another regulated industry.
• Experience testing complex transactional applications where authorization or business‑logic failures can affect financial data, customer information, or transaction integrity.
• Experience testing cloud‑native, API‑heavy, microservices, and modern identity‑based architectures.
• Experience with source‑assisted or white‑box penetration testing and secure code review.
• Familiarity with CI/CD pipelines, DevSecOps practices, and modern software‑development environments.
• Hands‑on certifications such as OSWE, GWAPT, BSCP, OSCP, or an equivalent demonstration of advanced capability.