Senior Penetration Tester (Web and API)

Invadel; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Invadel is seeking a senior penetration tester to lead scoped security assessments of web applications and APIs. The role emphasizes manual testing to safely demonstrate issues and provide remediation guidance for engineers and auditors.

Responsibilities include planning, executing, and retesting tests across authentication, authorization, sessions, and more, with clear executive summaries and CVSS scoring in reports. The position is full-time and remote within the United States.

Qualifications

• At least five years of hands-on application penetration testing, focused on web and API testing.
• Deep testing experience with modern app patterns (SPA, GraphQL, OAuth/OIDC, multi-tenant SaaS).
• Based in the United States and authorized to work there; engagements follow US time zones.
• Able to write reports with clear remediation steps and provide auditors with evidence; redacted sample report required.
• Provide two professional references who have seen live engagement work.

Responsibilities

• Lead scoped penetration tests of web apps and APIs from planning to retesting.
• Verify automated findings by hand and connect weaknesses into realistic attack paths.
• Escalate critical issues promptly after confirmation.
• Produce executive summaries, reproducible findings, CVSS scores, and remediation guidance in reports.
• Retest remediated findings and revise the report.
• Participate in client scoping calls when tester input is needed.

Skills

Hands-on testing

Web & API testing

Reporting & remediation guidance

Engagement scoping & client comms

Education

Offensive security certification

Tools

MASVS

MASTG

AWS

Azure

GCP

Job description

Role overview

Lead scoped penetration tests of web applications and APIs, from planning through retesting. The work is primarily manual and aims to find, safely demonstrate, and clearly explain security issues in ways that support both engineering remediation and compliance evidence.

Responsibilities

• Test web applications and APIs across user roles, covering areas such as authentication, authorization, sessions, injection, business logic, server-side request forgery, file handling, and deserialization.
• Verify automated findings by hand, connect related weaknesses into realistic attack paths, and demonstrate impact within the agreed rules of engagement.
• Escalate critical issues promptly after confirmation.
• Produce reports with an executive summary, reproducible technical findings, CVSS scores, prioritized remediation, and relevant framework mappings.
• Retest remediated findings and revise the report.
• Participate in client scoping calls when tester input is needed.

Requirements

• At least five years of hands-on application penetration testing, with most experience focused on web and API testing.
• Deep testing experience with at least one modern application pattern, such as single-page applications, GraphQL, OAuth or OIDC flows, or multi-tenant SaaS.
• Based in the United States and authorized to work there; engagements follow US time zones.
• Able to write reports that give engineers clear remediation steps and provide auditors with reviewable evidence; a redacted sample report is required with the application.
• Comfortable working to a written scope, raising concerns early, and providing two professional references who have seen live engagement work.

Nice to have

• Mobile testing experience using MASVS or MASTG, or cloud testing on AWS, Azure, or GCP.
• Published security research, testing tools, or disclosed vulnerabilities in third-party software.
• An offensive security certification; practical engagement experience is also required.

Benefits and work setup

Full-time, remote employment within the United States. A typical engagement involves five to ten testing days plus a retest. Initial onboarding to the testing platform and reporting templates takes about one day.