Lead Web Application Penetration Tester- Onsite

Calance, Inc.; Charlotte (NC); On-site; USD 83,000 - 96,000; Full time

Job summary

Calance, Inc. in Charlotte, NC seeks an experienced Lead Web Application Penetration Tester to drive security assessments of modern web apps and APIs onsite.

You will focus on identifying logic, auth, API, and session-related risks while guiding the engagement from scoping through delivery. The ideal candidate has hands-on Burp Suite expertise, deep OWASP knowledge, and a proven track record leading assessments and delivering actionable remediation guidance to stakeholders.

Qualifications

• Strong experience in web application penetration testing.
• Proficiency with Burp Suite and related offensive testing tools.
• Solid understanding of the OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and GraphQL APIs.
• Knowledge of authentication, authorization, cookies, tokens, session management, and modern web architecture.
• Excellent report writing, remediation advisory, and communication skills.
• Ability to lead assessments from scoping through delivery.
• Relevant certifications such as OSCP, OSEP, GWAPT, or equivalent.

Responsibilities

• Lead and execute advanced penetration tests against web applications, APIs, and related services.
• Test complex workflows such as onboarding, checkout, account recovery, role escalation, and payments.
• Perform manual and automated testing using Burp Suite and OWASP tools.
• Analyze API security issues including authorization, mass assignment, and broken object references.
• Identify weaknesses in rate limiting, input validation, error handling, and session management.
• Reconnaissance and mapping to identify endpoints, parameters, and exposed surfaces.
• Enumerate and test user roles, permissions, and privilege boundaries.
• Provide remediation advisory to owners and stakeholders.

Skills

Web app pentesting

Burp Suite

OWASP Top 10

REST APIs

GraphQL

Security tooling

Remediation reporting

Tools

Burp Suite

OWASP ZAP

Postman

Job description

Duration 1 year

Start Date ASAP

Location Charlotte, NC

Job Title Lead Web Application Penetration Tester- Onsite - ID: 45113

Advanced Web Application Penetration Tester

Role Summary

We are seeking an experienced Advanced Web Application Penetration Tester to lead security assessments of modern web applications and APIs. This role will focus on uncovering vulnerabilities in application logic, authentication and authorization controls, API endpoints, session handling, and other attack paths commonly targeted in real-world engagements. The ideal candidate is highly skilled in manual testing, has deep experience with tools such as Burp Suite and other OWASP-aligned testing utilities, and can combine automated and human-led techniques to identify high-impact risks

Key Responsibilities

• Lead and execute advanced penetration tests against web applications, APIs, and related services.
• Test complex business workflows such as user onboarding, checkout/cart flows, account recovery, role escalation, payment actions, and transaction handling.
• Perform manual and automated testing using Burp Suite, OWASP tools, and other security testing utilities.
• Analyze and attack API security issues, including object-level authorization, function-level authorization, mass assignment, excessive data exposure, and broken object references.
• Identify weaknesses in rate limiting, input validation, error handling, file upload processing, and trust boundaries.
• Perform reconnaissance and application mapping to identify endpoints, parameters, hidden functionality, and exposed surfaces.
• Enumerate and test user roles, permissions, and privilege boundaries.
• Probe for broken session management, token handling issues, and weak logout / session invalidation behavior.
• Test input handling for client-side and server-side validation issues, including edge cases and error-based disclosures.
• Provide remediation advisory to application owners, developers, and security stakeholders on how to address identified findings.

Required Qualifications

• Strong experience in web application penetration testing
• Demonstrated proficiency with Burp Suite and related offensive testing tools.
• Solid understanding of the OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and/or GraphQL APIs.
• Strong knowledge of authentication, authorization, cookies, tokens, session management, and modern web architecture.
• Excellent report writing, remediation advisory, and communication skills.
• Ability to work independently and lead assessments from scoping through delivery.
• Knowledge of SAST, DAST, SCA, and API security tooling.
• Relevant certifications such as OSCP, OSEP, GWAPT, or equivalent.

Pay Range - 60-70/hr

Contact Information

[e-mail]

About Calance

Calance is a global IT Services firm specializing in end-to-end solutions for Development, Managed Service, Security, SAP, Project Control Integration and IT Staffing. Operating in the United States and India, Calance helps clients bring their ideas and strategies to life through talent, technology and tenacity.

2020 All rights reserved.