Web Application Penetration Testing Engineer - AI

Web Application & API Penetration Testing

• Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services.
• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, APIs, data flows, and critical business workflows.
• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.

Offensive AI & AI-Assisted Testing

• Leverage approved offensive AI technologies and LLM-based security tooling throughout the penetration-testing lifecycle.
• Use AI to assist with reconnaissance, attack-surface analysis, endpoint and API analysis, test-case generation, vulnerability hypothesis development, and attack-path identification.
• Apply AI-assisted analysis to identify unusual behavior, authorization inconsistencies, business-logic weaknesses, and potential multi-step exploitation paths.
• Develop reusable prompts, Python scripts, agents, API integrations, or workflows that increase testing speed, consistency, depth, and coverage.

Reporting, Remediation & Program Improvement

• Produce high-quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.
• Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting.

Required Qualifications

• 5+ years of hands-on application security or penetration-testing experience, with substantial experience testing web applications and APIs.
• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.
• Advanced hands-on experience with Burp Suite Professional and related offensive-security tooling.
• Ability to develop scripts or lightweight tooling in Python, JavaScript, PowerShell, Bash, or an equivalent language.

Required Offensive AI Experience

• Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows.
• Ability to combine AI reasoning with expert manual penetration testing rather than treating AI output as authoritative.
• Experience building or modifying Python-based security automation, API integrations, prompt workflows, or agentic testing capabilities.
• Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses.
• Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.