Senior Web App Penetration Tester - Lead API & App Security

Calance; Charlotte (NC); On-site; USD 110,000 - 150,000; Full time

Job summary

Calance seeks an experienced Lead Web Application Penetration Tester for an onsite, one-year contract. The role focuses on identifying vulnerabilities in modern web apps and APIs, emphasizing logic flaws, auth controls, and API endpoints. You will combine manual testing with automated tools like Burp Suite to uncover high-impact risks.

Strong reporting, remediation guidance, and stakeholder communication are essential as you lead scoping through delivery. Relevant certifications are preferred.

Qualifications

• Strong experience in web application penetration testing.
• Proficient with Burp Suite and related offensive testing tools.
• Solid understanding of the OWASP Top 10 and OWASP API Security Top 10.
• Experience testing REST and/or GraphQL APIs.
• Excellent report writing, remediation advisory, and communication skills.
• Ability to work independently and lead assessments from scoping through delivery.
• Knowledge of SAST, DAST, SCA, and API security tooling.
• Certifications such as OSCP, OSEP, GWAPT, or equivalent.

Responsibilities

• Lead and execute advanced penetration tests against web applications, APIs, and related services.
• Test complex business workflows such as user onboarding, checkout flows, and account recovery.
• Perform manual and automated testing using Burp Suite and OWASP tools.
• Provide remediation advisory to owners, developers, and security stakeholders.

Skills

Web app pentesting

Manual testing

API security

Report writing

Leadership

Education

OSCP

OSEP

GWAPT

Tools

Burp Suite

OWASP testing tools

Job description

Calance seeks an experienced Lead Web Application Penetration Tester for an onsite, one-year contract. The role focuses on identifying vulnerabilities in modern web apps and APIs, emphasizing logic flaws, auth controls, and API endpoints. You will combine manual testing with automated tools like Burp Suite to uncover high-impact risks.

Strong reporting, remediation guidance, and stakeholder communication are essential as you lead scoping through delivery. Relevant certifications are preferred.