Senior Penetration Tester (Web and API), Contract

Invadel; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

Invadel, a New York City penetration testing firm, seeks an experienced penetration tester for contract work remote within the United States. You will lead manual tests on web apps and APIs, validate automated results, and present clear risk findings with reproducible steps.

You will also draft executive summaries and remediation guidance, then retest fixes. Ideal candidates have 5+ years of hands-on testing, deep stack expertise (SPA, GraphQL, OAuth/OIDC), and strong reporting skills for

Qualifications

• Five+ years of hands-on application penetration testing, focused on web apps and APIs.
• Depth on at least one modern stack (SPA, GraphQL, OAuth and OIDC, multi-tenant SaaS).
• Based in the United States with authorization to work here.
• Reports written for engineers and auditors, with a redacted sample report as part of the application.
• Two professional references required.

Responsibilities

• Lead manual web application and API penetration tests across every user role (authorization, authentication and sessions, injection, business logic, SSRF, file handling and deserialization).
• Confirm or discard every automated result by hand and chain findings to prove impact safely.
• Elevate critical findings the day they are confirmed.
• Write the report (executive summary, findings with reproduction steps and CVSS scores, prioritized remediation, framework mapping).
• Retest remediated findings.

Skills

Penetration testing

Web/API testing

Report writing

Client communication

Engagement management

Job description

Invadel is a New York City penetration testing firm. Every engagement is fixed-scope and fixed-price, agreed in writing, with public prices at invadel.com/pricing and a free retest. This is a contract role, remote within the United States, paid per engagement; a typical engagement is five to ten testing days plus a retest, scheduled around your availability.

What you will do:

• lead manual web application and API penetration tests across every user role (authorization, authentication and sessions, injection, business logic, SSRF, file handling and deserialization)
• confirm or discard every automated result by hand and chain findings to prove impact safely
• elevate critical findings the day they are confirmed
• write the report (executive summary, findings with reproduction steps and CVSS scores, prioritized remediation, framework mapping)
• retest remediated findings

What we need:

• five or more years of hands‑on application penetration testing, mostly web and API
• depth on at least one modern stack (single‑page applications, GraphQL, OAuth and OIDC, multi‑tenant SaaS)
• based in the United States with authorization to work here
• reports written for engineers and auditors, with a redacted sample report as part of the application
• two professional references

Nice to have:

• mobile (MASVS and MASTG) or cloud testing on AWS, Azure or GCP
• published research, tooling or disclosed vulnerabilities

An offensive security certification is welcome; it does not replace a verifiable engagement record.