Senior Application Security Engineer (Penetration Testing & Offensive AI)

Key Responsibilities

Web Application & API Penetration Testing

• Perform comprehensive penetration testing on web applications, APIs, and supporting services.
• Conduct threat modeling and assess application architecture, authentication, authorization, data flows, and business processes.
• Identify and validate complex security vulnerabilities, including access control issues, IDOR/BOLA/BFLA, injection flaws, privilege escalation, and business logic weaknesses.
• Perform advanced manual security testing beyond automated vulnerability scanning.
• Develop reproducible proof-of-concept demonstrations to assess security risks and business impact.
• Evaluate security issues across different user roles, access levels, and application workflows.

Offensive AI & AI-Assisted Security Testing

• Utilize approved AI-assisted security tools and Large Language Models (LLMs) to support penetration testing activities.
• Apply AI technologies for reconnaissance, vulnerability analysis, test-case development, and attack-path identification.
• Combine AI-assisted findings with manual testing using Burp Suite Professional and other security tools.
• Independently validate AI-generated findings to ensure accuracy and eliminate false positives.
• Develop Python scripts, automation tools, and AI-assisted workflows to improve testing efficiency and coverage.
• Ensure responsible handling of sensitive information and compliance with approved AI security practices.

Security Reporting & Collaboration

• Prepare detailed penetration testing reports, including identified vulnerabilities, risk assessments, supporting evidence, and remediation recommendations.
• Collaborate with development and engineering teams to resolve security vulnerabilities and conduct retesting.
• Identify recurring security weaknesses and recommend improvements to application security.
• Enhance penetration testing methodologies, tools, and security assessment processes.
• Provide technical guidance, knowledge sharing, and support to other security team members.
• Ensure all security testing activities comply with authorized testing scope, security policies, and data protection requirements.

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
• At least 5 years of hands-on experience in Application Security or Penetration Testing, particularly in web applications and APIs.
• Strong knowledge of HTTP, REST APIs, authentication, authorization, session management, OAuth 2.0, and OpenID Connect.
• Proven experience in manual penetration testing, vulnerability exploitation, and identifying complex business logic and access control issues.
• Advanced experience with Burp Suite Professional and other penetration testing tools.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide.
• Experience analyzing HTTP requests, API parameters, authentication tokens, headers, and application security controls.
• Knowledge of scripting and automation using Python, JavaScript, PowerShell, Bash, or similar languages.
• Strong analytical, problem-solving, technical documentation, and communication skills.

Required Offensive AI Experience

• Hands-on experience using AI-assisted security tools or Large Language Models (LLMs) in penetration testing or offensive security activities.
• Ability to integrate AI-assisted analysis with manual penetration testing and independently validate security findings.
• Experience developing Python-based security automation, AI-assisted workflows, API integrations, or prompt-based testing tools.
• Understanding of AI limitations, including false positives, hallucinations, and inaccurate vulnerability assessments.
• Knowledge of prompt engineering and AI-assisted security analysis.
• Ability to maintain data confidentiality and follow security standards when using AI technologies.

Preferred Qualifications

• Experience in penetration testing within banking, financial services, or other regulated industries.
• Knowledge of security testing for financial transactions, customer information, and complex business applications.
• Experience with cloud-native applications, microservices, API security, and modern authentication architectures.
• Familiarity with secure code review, white-box testing, CI/CD pipelines, and DevSecOps practices.
• Relevant certifications such as OSWE, GWAPT, BSCP, OSCP, or equivalent hands-on security expertise.