Penetration Tester – Web, Mobile & API Security

About the role

We are looking for a hands‑on Penetration Tester to perform comprehensive security assessments of our web applications, mobile apps (Android & iOS) and APIs. The role requires deep manual testing, strong methodology, and clear reporting throughout the testing lifecycle.

Key responsibilities

• Conduct manual black‑box and grey‑box testing of web and mobile applications following the OWASP Top 10.
• Identify and exploit vulnerabilities such as SQLi, XSS, CSRF, IDOR, SSRF, broken authentication, and access‑control flaws.
• Assess session management, cookies, HTTP headers and client‑side JavaScript logic.
• Perform static and dynamic analysis of Android and iOS apps using OWASP MASVS guidelines, including reverse engineering, hard‑coded secret detection, insecure local storage checks, SSL‑pinning bypass, and biometric bypass testing.
• Test REST endpoints against the OWASP API Security Top 10, focusing on BOLA, JWT abuse, OAuth 2.0 flaws, mass assignment and rate‑limiting gaps.
• Produce CVSS‑scored findings with reproducible steps, proof‑of‑concept screenshots, executive summaries for management and detailed technical reports for developers.
• Provide a prioritized remediation roadmap and re‑test after fixes.

Required profile

• Minimum 3 years of hands‑on penetration testing experience with a focus on web and mobile applications.
• Strong knowledge of OWASP Top 10, OWASP MASVS and OWASP API Security Top 10.
• Practical experience testing Android and iOS applications.
• Ability to write professional reports for both technical and non‑technical audiences.

Required skills

• Burp Suite Pro, OWASP ZAP, SQLMap, Nikto, Gobuster
• MobSF, jadx, apktool, Frida, Objection, ADB
• Charles Proxy, Postman, jwt_tool, InQL