Application Security Engineer/Penetration Tester

As part of the Security team, you will work closely with product and engineering teams to ensure the security of web, mobile applications, and cloud infrastructure.

You will take ownership of security assessments, contribute to secure development practices, and help drive security maturity across the organization.

Role and Responsibilities

• Perform penetration testing and security assessments of:

  • Web applications and APIs

  • iOS/Android applications

  • GCP Cloud infrastructure

• Identify vulnerabilities and clearly communicate risks and impact.

• Produce high-quality security reports with:

  • clear reproduction steps

  • realistic impact assessment

  • practical remediation guidance

• Work closely with developers and product teams to:

  • explain vulnerabilities

  • support remediation

  • validate fixes

• Improve internal security processes, tools, and methodologies.

• Participate in secure coding training and knowledge sharing.

Requirements

Required Technical and Professional Expertise

• 3+ years of hands-on experience in application security/penetration testing.

• Strong practical experience in:

  • Web application security testing (OWASP WSTG, ASWS, or equivalent)

  • API security (auth flows, business logic, abuse cases)

  • Mobile Application Security (OWASP MAS)

• Solid understanding of common security weaknesses and attack vectors for GCP and Kubernetes

• Solid understanding of:

  • Common vulnerability classes and their root causes

  • Client-server interaction models

  • Network communication protocols

  • Modern web technologies

  • Authentication mechanisms

  • Secure Software Development Lifecycle

• Foundational Knowledge of AI Security

  • Understanding of the OWASP Top 10 for LLM Applications (e.g., Prompt Injection, Sensitive Data Disclosure, Insecure Output Handling)

  • Proficiency in using LLMs and AI-powered tools to accelerate vulnerability analysis, deobfuscate code, and automate the creation of custom security tools or exploit scripts

  • Prompt Engineering: Ability to craft and refine complex prompts for deep-dive code analysis (SAST) and generating context-aware test cases for business logic flaws

• Hands-on experience with tools such as:

  • Burp Suite (advanced usage)

  • Proxies, fuzzers, scanners

  • SAST / DAST tools

  • Basic RE tools (Ghidra, jadx, Hopper, dnSpy — at least on a basic level)

  • AI Productivity Tools: AI-assisted coding environments (e.g., GitHub Copilot, Cursor, or Claude Code) to streamline security auditing and remediation workflows

  • MCP Servers for common pen testing tools

• Strong communication skills:

  • Ability to explain security issues to engineers

  • Clear and structured reporting in English

  • Ability to work independently and take ownership.

Nice to Have:

• Experience in bug bounty, public vulnerability disclosures or CTF competitions.

• Development background (ability to read and understand production code).

• Experience with desktop application testing (Windows).

• Experience with hardware, firmware testing, and BLE protocol.

• Experience in Threat modeling and Architecture reviews

• Familiarity with privacy and compliance frameworks (GDPR, ISO 27001, SOC2, etc.)

• Relevant certifications like CEH, BSCP, eWPT, OSCP, etc.