Lead Web App Penetration Tester – Onsite Charlotte

Calance, Inc.; Charlotte (NC); On-site; USD 83,000 - 96,000; Full time

Job summary

Calance, Inc. in Charlotte, NC seeks an experienced Lead Web Application Penetration Tester to drive security assessments of modern web apps and APIs onsite.

You will focus on identifying logic, auth, API, and session-related risks while guiding the engagement from scoping through delivery. The ideal candidate has hands-on Burp Suite expertise, deep OWASP knowledge, and a proven track record leading assessments and delivering actionable remediation guidance to stakeholders.

Qualifications

• Strong experience in web application penetration testing.
• Proficiency with Burp Suite and related offensive testing tools.
• Solid understanding of the OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and GraphQL APIs.
• Knowledge of authentication, authorization, cookies, tokens, session management, and modern web architecture.
• Excellent report writing, remediation advisory, and communication skills.
• Ability to lead assessments from scoping through delivery.
• Relevant certifications such as OSCP, OSEP, GWAPT, or equivalent.

Responsibilities

• Lead and execute advanced penetration tests against web applications, APIs, and related services.
• Test complex workflows such as onboarding, checkout, account recovery, role escalation, and payments.
• Perform manual and automated testing using Burp Suite and OWASP tools.
• Analyze API security issues including authorization, mass assignment, and broken object references.
• Identify weaknesses in rate limiting, input validation, error handling, and session management.
• Reconnaissance and mapping to identify endpoints, parameters, and exposed surfaces.
• Enumerate and test user roles, permissions, and privilege boundaries.
• Provide remediation advisory to owners and stakeholders.

Skills

Web app pentesting

Burp Suite

OWASP Top 10

REST APIs

GraphQL

Security tooling

Remediation reporting

Tools

Burp Suite

OWASP ZAP

Postman

Job description

Calance, Inc. in Charlotte, NC seeks an experienced Lead Web Application Penetration Tester to drive security assessments of modern web apps and APIs onsite.

You will focus on identifying logic, auth, API, and session-related risks while guiding the engagement from scoping through delivery. The ideal candidate has hands-on Burp Suite expertise, deep OWASP knowledge, and a proven track record leading assessments and delivering actionable remediation guidance to stakeholders.