Remote Senior Penetration Tester - Web & API (Contract)

Embedded Shishya; United States; Remote; USD 166,000 - 332,000; Full time

Job summary

Invadel in New York City is seeking an experienced penetration tester to lead web application and API engagements on a contract basis, remote within the United States. You will own testing from scoping through to report delivery and retesting, coordinating with clients as needed.

The role requires deep hands-on testing expertise, strong report writing, and the ability to validate findings against manual and automated results.

Qualifications

• 5+ years of hands-on application penetration testing, focusing on web apps and APIs.
• Depth on modern stacks (SPAs, GraphQL, OAuth/OIDC, multi-tenant SaaS).
• Based in the United States and authorized to work here.
• Experience writing reports for engineers and auditors with redacted sample reports.
• Two professional references required.

Responsibilities

• Lead manual web application and API penetration tests across all user roles.
• Verify automated results by hand and chain findings to prove impact.
• Escalate critical findings immediately when confirmed.
• Write executive summaries, findings with reproduction steps and CVSS scores, remediation guidance and framework mapping.
• Retest remediated findings.

Skills

Penetration testing

Web apps & APIs

Reporting & documentation

Leadership / coordination

Tools

Burp Suite

OWASP ZAP

Cloud testing tools

Job description

Invadel in New York City is seeking an experienced penetration tester to lead web application and API engagements on a contract basis, remote within the United States. You will own testing from scoping through to report delivery and retesting, coordinating with clients as needed.

The role requires deep hands-on testing expertise, strong report writing, and the ability to validate findings against manual and automated results.