The role
Job description
Key Responsibilities
Conduct web application and API penetration testing.
Identify vulnerabilities aligned with OWASP Top 10 and OWASP API Security Top 10.
Assess authentication, session management, access controls, privilege escalation and IDOR vulnerabilities.
Test injection vulnerabilities, file uploads and business logic, particularly onboarding and ACH/payment workflows.
Perform AWS security assessments covering IAM, S3, security groups, ECR, logging and monitoring.
Evaluate external attack surfaces and network exposure.
Assess Amazon SES configurations, SPF, DKIM, DMARC, SMTP credential security and email injection risks.
Prepare detailed vulnerability reports with CVSS scores, proof of concepts and remediation recommendations.
Conduct vulnerability retesting after remediation.
Support SOC 2 audit requirements by providing security testing evidence.
Required Technical Skills
Hands-on web application and API penetration testing.
Tools: Burp Suite Professional, OWASP ZAP and Postman.
AWS security assessment using Prowler, ScoutSuite or Pacu.
Network testing using Nmap and Metasploit.
Knowledge of Docker and container security.
Strong understanding of web application security, APIs and cloud infrastructure.
Experience preparing technical security reports and remediation guidance.
Understanding of SOC 2 and ISO 27001 compliance requirements.
Preferred Qualifications
OSCP, eWPTX, CEH (Practical) or AWS Certified Security – Specialty.
Experience with Vanta or similar compliance platforms.
Experience conducting security assessments for AWS-hosted applications.
Expected Deliverables
Rules of Engagement (RoE) and approved penetration testing plan.
Executive summary and detailed technical assessment report.
Vulnerability evidence, CVSS scoring and remediation recommendations.
Post-remediation retesting report.
Closure letter supporting SOC 2 auditor requirements.