Senior Penetration Tester API, Web & Cloud

Distribusion Technologies; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-friendly

International opportunities

Job summary

Distribusion Technologies is seeking a Senior Penetration Tester to join our remote-first security team. You will conduct hands-on testing across partner APIs, web and mobile apps, and cloud infrastructure to identify critical vulnerabilities before deployment.

You will collaborate with engineering squads to validate findings, demonstrate risk, and drive practical remediations with clear guidance and retesting to ensure secure production systems.

Qualifications

• 5+ years of hands-on pentesting for web apps and APIs.
• Deep knowledge of OWASP API Top 10, WSTG and ASVS.
• Experience with OAuth2/OIDC, JWT, API keys and request signing.
• Identify business-logic and race-condition vulnerabilities in transactional systems.
• Fluent with scripting languages (Python or Go) and tooling.

Responsibilities

• Test partner-facing booking APIs against OWASP API Top 10 with focus on authorization and data exposure.
• Assess API authentication end-to-end, including OAuth2/OIDC and JWTs.
• Hunt for business-logic abuse in booking, checkout, payments or refunds flows.
• Run authenticated tests of web and mobile apps following OWASP WSTG and ASVS.
• Review cloud, Kubernetes and CI/CD configurations for attack paths.
• Map and regularly test internet-facing attack surface.
• Red-team AI features against OWASP Top 10 for LLM Apps.
• Document findings with remediation guidance and verify via retests.

Skills

Penetration testing

Web applications

APIs

OWASP API Top 10

OAuth 2.0/OIDC

JWT

Scripting (Python/Go)

Education

OSCP

OSWE

BSCP or similar

Tools

Burp Suite Pro

Kubernetes

GCP

Job description

Distribusion is the world's leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase.

We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com. We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.

We are looking for an experienced Senior Penetration Tester to join us as soon as possible. You will run hands-on, authenticated security testing across a real attack surface: public partner-facing booking APIs, payment flows, web and mobile apps used by millions of travellers, and the cloud infrastructure behind them. You'll plan and run your own testing, work directly with our engineering squads to get findings fixed, and see your impact in production within weeks.

What you will do:

Test our partner-facing booking APIs against the OWASP API Security Top 10, with a focus on object- and function-level authorization, tenant isolation, mass assignment, data exposure and rate limiting. Assess API authentication and integrity end to end, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing. Hunt for business-logic abuse in booking, checkout, payment and refund flows, including race conditions and pricing manipulation. Run authenticated tests of traveller-, partner- and operator-facing web and mobile apps following OWASP WSTG and ASVS, including how passenger personal data is stored, shown and exported. Review cloud, Kubernetes and CI/CD configurations and secrets handling for attack paths that could be chained from an application bug. Map and regularly test our internet-facing attack surface. Red-team our AI features (assistants, agents, support bots) against the OWASP Top 10 for LLM Applications. Write clear, reproducible, risk-rated findings with practical remediation guidance, walk engineers through fixes and verify them with retests.

Workplace:

We are a remote-first company with teams located around the Globe and a HQ in Berlin.

Who you are:

You bring 5+ years of hands-on penetration testing, mainly of web applications and APIs, and can point to recent engagements you've led end to end. You have deep, practical knowledge of the OWASP API Security Top 10, WSTG and ASVS, including authentication/authorization models (OAuth2/OIDC, JWT), IDOR/BOLA, mass assignment, SSRF, injection and XSS. You have found business-logic and race-condition vulnerabilities in transactional systems such as booking, e-commerce, payments or fintech. You are fluent with Burp Suite Pro (or similar) and write your own scripts and tooling (Python, Go or similar). You are comfortable assessing cloud and container environments (GCP preferred, Kubernetes) and CI/CD pipelines. You work independently: you scope, prioritise, test and report with minimal guidance, and you explain complex risks plainly to engineers and leadership. You are available to start at short notice.

Bonus Points:

OSCP, OSWE, BSCP or similar certifications; experience red-teaming LLM applications or AI agents; testing in PCI-DSS environments.

What you can expect:

You will join a fast-paced travel tech company with a flat organizational structure. You will have exciting opportunities, ownership, and responsibility and contribute directly to the success of the company. You will join an international team of talented and driven people with a clear mission. Expect your colleagues to inspire, support and challenge you every day! We have a flexible work policy with the option of working remotely and international opportunities arising as we continue to expand our global footprint - Our heart is in Berlin, but you'll find us across the globe. You will get a competitive salary.

Our hiring team for this role:

Your Talent Partner (TP) and point of contact is Lorena Rebenciuc, and the Hiring Manager (HM) is Ilya Isakov.