Senior Web & API Penetration Tester

ITR Group; Minneapolis (MN); On-site; USD 110,000 - 124,000; Full time

Job summary

ITR Group is seeking a Senior Penetration Tester to lead hands-on testing of web applications and APIs in enterprise environments. The role requires independent management of engagements from scoping through reporting and remediation validation.

The candidate should have advanced Burp Suite experience and at least 5+ years of hands-on testing. Strong scripting skills (Python/Go) and collaboration with engineering teams are essential.

Qualifications

• 5+ years of hands-on penetration testing experience.
• Strong web application and API penetration testing experience.
• Experience independently executing end-to-end penetration tests.
• Strong understanding of application vulnerabilities.
• Advanced Burp Suite experience.
• Experience with Nmap and exploitation frameworks.
• Python or Go scripting/automation experience.
• Strong technical documentation and communication skills.
• Experience working directly with engineering teams on remediation.

Responsibilities

• Execute end-to-end penetration tests, including scoping, exploitation, validation, reporting, and remediation support.
• Perform web application and API security testing.
• Identify and evaluate OWASP Top 10 and other application vulnerabilities.
• Assess authentication, authorization, injection, and other security weaknesses.
• Use Burp Suite, Nmap, and common exploitation frameworks.
• Develop Python or Go scripts and automation to support testing workflows.
• Document findings with actionable remediation guidance.
• Partner with engineering teams to validate and remediate vulnerabilities.
• Contribute to improving penetration testing processes and tooling.

Skills

Penetration testing

Web app testing

API testing

Burp Suite

Nmap

Exploitation frameworks

Python scripting

Go scripting

Documentation

Engineering collaboration

Education

Bachelor's degree in CS/Cybersecurity

7+ years cybersecurity experience

Tools

Burp Suite

Nmap

Job description

ITR Group is seeking a Senior Penetration Tester to lead hands-on testing of web applications and APIs in enterprise environments. The role requires independent management of engagements from scoping through reporting and remediation validation.

The candidate should have advanced Burp Suite experience and at least 5+ years of hands-on testing. Strong scripting skills (Python/Go) and collaboration with engineering teams are essential.