Senior Offensive Security Tester

Location: Offshore or Nearshore (remote) Engagement: Full-time, dedicated to client

What you'll do

• Run ongoing offensive testing across web applications, APIs, internal networks and cloud configurations,

closing the gaps between annual pen tests and one-off engagements

• Target policy administration, claims processing and customer/agent portals, with emphasis on business-logic

flaws such as rate manipulation, claims fraud vectors and authorization bypass

• Build and maintain custom exploit and test tooling tailored to the client's tech stack, reducing reliance on

generic scanners

• Validate and document findings with clear reproduction steps, severity and business impact

• Feed findings into a remediation-tracking loop with engineering and retest fixes to shorten time-to-fix on

critical vulnerabilities

• Work with the GRC team to translate findings into risk-register entries

Requirements

• 6+ years in offensive security, penetration testing or red teaming

• Deep hands-on experience with web app and API testing (OWASP Top 10, OWASP API Top 10), internal

network exploitation and Active Directory attacks

• Cloud security testing experience in AWS and/or Azure (IAM misconfigurations, exposed services, privilege

escalation)

• Proficiency with Burp Suite Pro, Metasploit, BloodHound, Nmap and similar tools

• Scripting and tool development in Python, Go, PowerShell or similar

• Strong written English for technical reports and executive summaries

• Overlap with U.S. business hours

Nice to have

• OSCP, OSEP, OSWE, GPEN, GWAPT or CRTO

• Experience in insurance, financial services or healthcare

• Exposure to mainframe or legacy core insurance platforms