Senior Penetration Tester: API, Web & Cloud (Remote)

Distribusion Technologies; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-friendly

International opportunities

Flat structure

Competitive salary

Job summary

Distribusion Technologies is seeking a Senior Penetration Tester to join a remote-first team. You will conduct authenticated security testing across partner APIs, web and mobile applications, and cloud infrastructure, collaborating closely with engineering to fix findings.

You will leverage OWASP API Security Top 10, WSTG/ASVS, and CI/CD experience to identify risks, write actionable remediation guidance, and retest to verify fixes. Remote work with international opportunities included.

Qualifications

• 5+ years of hands-on penetration testing, primarily of web apps and APIs.
• Deep knowledge of OWASP API Security Top 10, WSTG and ASVS—incl. auth models (OAuth2/OIDC) and JWTs.
• Proven ability to find business-logic and race-condition vulnerabilities in transactional systems.

Responsibilities

• Test partner-facing booking APIs against the OWASP API Top 10 focusing on authorization, isolation, and data exposure.
• Assess API authentication/integrity end-to-end including OAuth2/OIDC, API keys, JWTs, webhooks, and request signing.
• Hunt for business-logic abuse in booking, checkout, and payments flows; perform authenticated tests of web/mobile apps.
• Review cloud, Kubernetes, and CI/CD configurations for attack paths; map and test attack surface regularly.
• Red-team AI features against OWASP Top 10 for LLM apps and document reproducible risk-rated findings with remediation guidance.

Skills

Penetration testing

Web APIs

OWASP API Security Top 10

WSTG/ASVS

OAuth2/OIDC

Burp Suite Pro

Python

Go

CI/CD security

Cloud / Kubernetes

Tools

Burp Suite Pro

Python

Go

Job description

Distribusion Technologies is seeking a Senior Penetration Tester to join a remote-first team. You will conduct authenticated security testing across partner APIs, web and mobile applications, and cloud infrastructure, collaborating closely with engineering to fix findings.

You will leverage OWASP API Security Top 10, WSTG/ASVS, and CI/CD experience to identify risks, write actionable remediation guidance, and retest to verify fixes. Remote work with international opportunities included.