Senior Offensive Security Tester

SMX Services & Consulting, Inc.; Dallas (TX); Remote; USD 120,000 - 180,000; Full time

Job summary

SMX Services & Consulting, Inc. is seeking an experienced offensive security professional to run pen tests across web apps, APIs, networks and cloud configurations for clients worldwide. You will document findings with reproducible steps, outline severity and business impact, and work with engineering and governance teams to drive remediation while meeting client SLAs.

This is a remote, full-time position that requires alignment with U.S. business hours.

Qualifications

• 6+ years in offensive security, penetration testing or red teaming.
• Deep hands-on testing of web apps, APIs, internal networks and AD attacks.
• Experience with cloud security testing in AWS and/or Azure.
• Proficiency with Burp Suite Pro, Metasploit, BloodHound and Nmap.
• Scripting in Python, Go or PowerShell.

Responsibilities

• Run ongoing offensive testing across web applications, APIs, internal networks and cloud configurations, closing gaps between annual pen tests and engagements.
• Target policy administration, claims processing and customer/agent portals with focus on business logic flaws.
• Build and maintain custom exploit and test tooling tailored to the client stack.
• Validate findings with reproduction steps, severity and business impact.
• Feed findings into remediation-tracking with engineering and retest fixes to shorten time-to-fix on critical vulnerabilities.
• Collaborate with GRC to translate findings into risk-register entries.

Skills

Penetration testing

Red teaming

Cloud security testing

Python scripting

Executive reporting

Tools

Burp Suite Pro

Metasploit

BloodHound

Nmap

Job description

Location: Offshore or Nearshore (remote)

Engagement: Full-time, dedicated to client

What you'll do

• Run ongoing offensive testing across web applications, APIs, internal networks and cloud configurations, closing the gaps between annual pen tests and one-off engagements
• Target policy administration, claims processing and customer/agent portals, with emphasis on business-logic flaws such as rate manipulation, claims fraud vectors and authorization bypass
• Build and maintain custom exploit and test tooling tailored to the client's tech stack, reducing reliance on generic scanners
• Validate and document findings with clear reproduction steps, severity and business impact
• Feed findings into a remediation-tracking loop with engineering and retest fixes to shorten time-to-fix on critical vulnerabilities
• Work with the GRC team to translate findings into risk-register entries

Requirements

• 6+ years in offensive security, penetration testing or red teaming
• Deep hands-on experience with web app and API testing (OWASP Top 10, OWASP API Top 10), internal network exploitation and Active Directory attacks
• Cloud security testing experience in AWS and/or Azure (IAM misconfigurations, exposed services, privilege escalation)
• Proficiency with Burp Suite Pro, Metasploit, BloodHound, Nmap and similar tools
• Scripting and tool development in Python, Go, PowerShell or similar
• Strong written English for technical reports and executive summaries
• Overlap with U.S. business hours

Nice to have

• Experience in insurance, financial services or healthcare
• Exposure to mainframe or legacy core insurance platforms