Senior Web & API Penetration Tester — Remote (US)

Invadel; USA; Remote; USD 120.000 - 180.000; Vollzeit

Zusammenfassung

Invadel is seeking a senior penetration tester to lead scoped security assessments of web applications and APIs. The role emphasizes manual testing to safely demonstrate issues and provide remediation guidance for engineers and auditors.

Responsibilities include planning, executing, and retesting tests across authentication, authorization, sessions, and more, with clear executive summaries and CVSS scoring in reports. The position is full-time and remote within the United States.

Qualifikationen

• At least five years of hands-on application penetration testing, focused on web and API testing.
• Deep testing experience with modern app patterns (SPA, GraphQL, OAuth/OIDC, multi-tenant SaaS).
• Based in the United States and authorized to work there; engagements follow US time zones.
• Able to write reports with clear remediation steps and provide auditors with evidence; redacted sample report required.
• Provide two professional references who have seen live engagement work.

Aufgaben

• Lead scoped penetration tests of web apps and APIs from planning to retesting.
• Verify automated findings by hand and connect weaknesses into realistic attack paths.
• Escalate critical issues promptly after confirmation.
• Produce executive summaries, reproducible findings, CVSS scores, and remediation guidance in reports.
• Retest remediated findings and revise the report.
• Participate in client scoping calls when tester input is needed.

Kenntnisse

Hands-on testing

Web & API testing

Reporting & remediation guidance

Engagement scoping & client comms

Ausbildung

Offensive security certification

Tools

MASVS

MASTG

AWS

Azure

GCP

Jobbeschreibung

Invadel is seeking a senior penetration tester to lead scoped security assessments of web applications and APIs. The role emphasizes manual testing to safely demonstrate issues and provide remediation guidance for engineers and auditors.

Responsibilities include planning, executing, and retesting tests across authentication, authorization, sessions, and more, with clear executive summaries and CVSS scoring in reports. The position is full-time and remote within the United States.