Senior API & Cloud Security Tester — Remote

Distribusion Technologies; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-friendly

International opportunities

Job summary

Distribusion Technologies is seeking a Senior Penetration Tester to join our remote-first security team. You will conduct hands-on testing across partner APIs, web and mobile apps, and cloud infrastructure to identify critical vulnerabilities before deployment.

You will collaborate with engineering squads to validate findings, demonstrate risk, and drive practical remediations with clear guidance and retesting to ensure secure production systems.

Qualifications

• 5+ years of hands-on pentesting for web apps and APIs.
• Deep knowledge of OWASP API Top 10, WSTG and ASVS.
• Experience with OAuth2/OIDC, JWT, API keys and request signing.
• Identify business-logic and race-condition vulnerabilities in transactional systems.
• Fluent with scripting languages (Python or Go) and tooling.

Responsibilities

• Test partner-facing booking APIs against OWASP API Top 10 with focus on authorization and data exposure.
• Assess API authentication end-to-end, including OAuth2/OIDC and JWTs.
• Hunt for business-logic abuse in booking, checkout, payments or refunds flows.
• Run authenticated tests of web and mobile apps following OWASP WSTG and ASVS.
• Review cloud, Kubernetes and CI/CD configurations for attack paths.
• Map and regularly test internet-facing attack surface.
• Red-team AI features against OWASP Top 10 for LLM Apps.
• Document findings with remediation guidance and verify via retests.

Skills

Penetration testing

Web applications

APIs

OWASP API Top 10

OAuth 2.0/OIDC

JWT

Scripting (Python/Go)

Education

OSCP

OSWE

BSCP or similar

Tools

Burp Suite Pro

Kubernetes

GCP

Job description

Distribusion Technologies is seeking a Senior Penetration Tester to join our remote-first security team. You will conduct hands-on testing across partner APIs, web and mobile apps, and cloud infrastructure to identify critical vulnerabilities before deployment.

You will collaborate with engineering squads to validate findings, demonstrate risk, and drive practical remediations with clear guidance and retesting to ensure secure production systems.