Lead Web and API Penetration Tester (Remote, US)

Invadel

United States

Remote

USD 120,000 - 170,000

Full time

14 days+

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Invadel, a New York City penetration testing firm, seeks an experienced penetration tester for contract work remote within the United States. You will lead manual tests on web apps and APIs, validate automated results, and present clear risk findings with reproducible steps.

You will also draft executive summaries and remediation guidance, then retest fixes. Ideal candidates have 5+ years of hands-on testing, deep stack expertise (SPA, GraphQL, OAuth/OIDC), and strong reporting skills for

Qualifications

Five+ years of hands-on application penetration testing, focused on web apps and APIs.
Depth on at least one modern stack (SPA, GraphQL, OAuth and OIDC, multi-tenant SaaS).
Based in the United States with authorization to work here.
Reports written for engineers and auditors, with a redacted sample report as part of the application.
Two professional references required.

Responsibilities

Lead manual web application and API penetration tests across every user role (authorization, authentication and sessions, injection, business logic, SSRF, file handling and deserialization).
Confirm or discard every automated result by hand and chain findings to prove impact safely.
Elevate critical findings the day they are confirmed.
Write the report (executive summary, findings with reproduction steps and CVSS scores, prioritized remediation, framework mapping).
Retest remediated findings.