{"id":3473178,"url":"https://alion.io/job/applaudo-senior-offensive-security-engineer-web-api","title":"Senior Offensive Security Engineer (Web & API)","company":{"id":5319,"name":"Applaudo","domain":"applaudostudios.com","url":"https://alion.io/company/applaudo-studios","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"contractor","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mexico City, Mexico"],"countries":["MX"],"hiring_countries":["MX"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":43000,"max_usd":99000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amass","optional":false},{"name":"Burp Suite","optional":false},{"name":"CVSS","optional":false},{"name":"HTTPX","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Nmap","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Rest API","optional":false},{"name":"SOAP","optional":false},{"name":"SoapUI","optional":false},{"name":"subfinder","optional":false},{"name":"API Gateway","optional":true},{"name":"ASP.NET Core","optional":true},{"name":"Azure","optional":true},{"name":"C#","optional":true},{"name":"Java","optional":true},{"name":"PCI DSS","optional":true},{"name":"Postman","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-29T16:24:34Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-01T21:11:11Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About You\nYou are an experienced offensive security professional with strong manual penetration testing expertise and a disciplined approach to testing production environments. You validate vulnerabilities through controlled exploitation attempts and produce clear, reproducible evidence.\nYou are comfortable testing web applications, REST/SOAP APIs, and applications protected by enterprise SSO. You understand how to assess authorization across roles and accounts, identify exploitable weaknesses, and explain their impact.\nNote: This role operates under a contractor model for an initial period of 2 months, with the possibility of extension.\nYou Bring to Applaudo the Following Competencies:\nBachelor’s Degree in Computer Science, Cybersecurity, Software Engineering, or a related field is desired, or equivalent professional experience.\n5+ years of hands on penetration testing experience, including 3+ years testing web applications and APIs in production environments.\nManual web application penetration testing following OWASP WSTG and the OWASP Top 10.\nAPI security testing following the OWASP API Security Top 10, including BOLA/IDOR and broken function level authorization.\nSOAP and WSDL web service testing using Burp Suite, SoapUI or an equivalent tool.\nBurp Suite Professional as your primary tool, including extensions and custom payloads.\nExperience testing applications protected by SSO with OAuth 2.0, OpenID Connect and SAML on Microsoft Entra ID.\nMulti role and multi account authorization testing methodology.\nExternal reconnaissance and attack surface enumeration using Amass, subfinder, httpx, Nmap or equivalent tooling.\nProven ability to test safely in production, applying rate control, test records and defined stop conditions.\nCVSS v3.1 scoring and regulator ready reporting supported by reproducible evidence.\nStrict adherence to rules of engagement, stopping and escalating within one hour when a stop condition is met.\nDocumentation discipline that records every attempt, successful or not, so results stand up to regulatory review.\nCommitment to collecting only the minimum evidence required and masking nonpublic information in all deliverables.\nStrong spoken and written English (B2+) to document findings and weekly status reports and to join live working sessions with a U.S. based security team.\nNice to haves:\nExperience testing Java EE and JSF enterprise applications, such as loan servicing or core lending platforms.\nExperience testing ASP.NET web applications and APIs.\nExperience with Azure API Management, Application Gateway or Front Door WAF.\nExperience testing payment, e signature and webhook or callback integrations.\nPython or Bash scripting to automate test cases.\nPrior participation in regulatory penetration tests under NYDFS Part 500, PCI DSS 11.4 or FFIEC.\nOffensive security certification such as OSCP, OSWE, GWAPT, GPEN, GXPN or BSCP.\nYou Will Be Accountable for the Following Responsibilities:\nPerform outside unauthenticated testing of in scope web applications, REST and SOAP APIs, an API gateway and internet exposed hosts.\nPerform inside testing from client provided accounts, covering cross role and cross account authorization, privilege escalation and access beyond the assigned role.\nDiscover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.\nBase every finding on an exploitation attempt and record its result, listing scan only items separately as untested.\nTest all authorized in scope assets, or document the reason for exclusion when client side dependencies are not met.\nExecute all testing without causing service disruption or data loss, escalating stop conditions within one hour.\nScore findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.\nContribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.\nSupport the revalidation report delivered within 60 days of the final report.\nReport weekly status in English and participate in working sessions with the client security team.\n 5+ years of hands on penetration testing, including 3+ years on web applications and APIs in production.\nManual testing aligned to OWASP WSTG, OWASP Top 10 and OWASP API Security Top 10.\nBurp Suite Professional expertise, including SOAP and WSDL service testing.\nAuthorization testing across multiple roles and accounts in SSO protected applications (Entra ID, OAuth 2.0, OIDC, SAML).\n About Us\nWe Are Engineered Different.\nAt Applaudo, talented people design, build, and scale meaningful, AI-powered solutions that create real business impact. As an AI-native organization, we collaborate across design, development, cloud, data, and artificial intelligence to turn ideas into scalable products that transform how companies operate, make decisions, and grow.\nWe are building a high-performance culture grounded in five values: Empowering Excellence, Collaborative Teamwork, Unsolicited Respect, Consistent Transparency, and Efficient Communication. These define how we work, how we support one another, and how we hold ourselves accountable.\nApplaudo is a place for people who want to learn fast, take ownership, and work alongside strong teams they are proud to belong to. Joining us means being part of an organization that is evolving intentionally, investing in modern ways of working, and leading AI-native transformation at scale.","description_format":"text","description_chars":5500,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Mexico","iso":"MX","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","UI/UX Design","IT Outsourcing & Dedicated Teams","Web Development Services"],"lifecycle":[{"event":"open","at":"2026-10-29T17:57:54Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":33,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/applaudo-senior-offensive-security-engineer-web-api","json_url":"https://alion.io/job/applaudo-senior-offensive-security-engineer-web-api.json","meta":{"generated_at":"2026-11-02T00:42:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1178,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5319},"rest":"https://alion.io/mcp/rest/get_company?id=5319"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fapplaudo-senior-offensive-security-engineer-web-api"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fapplaudo-senior-offensive-security-engineer-web-api"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fapplaudo-senior-offensive-security-engineer-web-api"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/applaudo-senior-offensive-security-engineer-web-api\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fapplaudo-senior-offensive-security-engineer-web-api"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3473178}},{"tool":"search_jobs","arguments":{"company":"applaudostudios.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3473178},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}