Senior Offensive Security Tester

Location: Offshore or Nearshore (remote)

Engagement: Full-time, dedicated to client

What you'll do

• Run ongoing offensive testing across web applications, APIs, internal networks and cloud configurations, closing the gaps between annual pen tests and one-off engagements
• Target policy administration, claims processing and customer/agent portals, with emphasis on business-logic flaws such as rate manipulation, claims fraud vectors and authorization bypass
• Build and maintain custom exploit and test tooling tailored to the client's tech stack, reducing reliance on generic scanners
• Validate and document findings with clear reproduction steps, severity and business impact
• Feed findings into a remediation-tracking loop with engineering and retest fixes to shorten time-to-fix on critical vulnerabilities
• Work with the GRC team to translate findings into risk-register entries

Requirements

• 6+ years in offensive security, penetration testing or red teaming
• Deep hands-on experience with web app and API testing (OWASP Top 10, OWASP API Top 10), internal network exploitation and Active Directory attacks
• Cloud security testing experience in AWS and/or Azure (IAM misconfigurations, exposed services, privilege escalation)
• Proficiency with Burp Suite Pro, Metasploit, BloodHound, Nmap and similar tools
• Scripting and tool development in Python, Go, PowerShell or similar
• Strong written English for technical reports and executive summaries
• Overlap with U.S. business hours

Nice to have

• Experience in insurance, financial services or healthcare
• Exposure to mainframe or legacy core insurance platforms