Senior Web App Security Engineer

About the role

We are looking for a Senior Web App Security Engineer to lead the assessment and hardening of our complex web applications, APIs and authentication systems. You will identify vulnerabilities, validate security controls and guide remediation to protect critical business processes and sensitive data.

Key responsibilities

• Perform manual and automated penetration testing of web applications, APIs, micro‑services and internet‑facing services.
• Assess file upload/download, storage and processing workflows for security weaknesses.
• Review role‑based and attribute‑based access controls, detecting IDOR, privilege escalation and unauthorized data access.
• Evaluate authentication and federation mechanisms such as OAuth 2.0, OpenID Connect, SAML and JWT, testing token validation, session handling and replay protection.
• Analyze business logic and workflow implementations for logic flaws, race conditions and insufficient rate‑limiting.
• Produce risk‑based assessment reports, prioritize remediation actions and verify fixes through re‑testing.

Required profile

• Minimum 5 years of hands‑on web application and API penetration testing experience.
• Deep knowledge of modern attack techniques and security testing methodologies.
• Familiarity with OWASP Top 10, OWASP API Security Top 10 and the OWASP Web Security Testing Guide.
• Experience with threat modeling and risk‑based assessments.

Required skills

• Burp Suite Professional
• Postman (or equivalent API testing tools)
• OAuth 2.0, OpenID Connect, JWT, SAML 2.0
• OWASP Top 10, OWASP API Security Top 10, OWASP WSTG
• Threat modeling and risk assessment methodologies