Senior Penetration Tester (Web and API), Contract

Overview

Our talent team at Get A Job.ai is representing a confidential cybersecurity firm in their search for a Senior Penetration Tester (Web and API) to join them on a contract basis. This is a remote opportunity within the United States, structured on a per-engagement basis with scheduling flexibility built around your availability.

Responsibilities

• Lead manual web application and API penetration tests across all user roles, covering authorization, authentication and session management, injection vulnerabilities, business logic flaws, SSRF, file handling and deserialization
• Confirm or discard automated scan results through hands-on validation and chain findings to demonstrate real-world impact in a safe manner
• Escalate critical findings to the client on the day they are confirmed
• Write comprehensive reports including executive summaries, detailed findings with reproduction steps and CVSS scores, prioritized remediation guidance, and framework mapping
• Conduct retests on remediated findings to validate fixes

What We're Looking For

Must-have qualifications:

• Five or more years of hands-on application penetration testing experience, primarily web and API focused
• Deep expertise in at least one modern application stack (single-page applications, GraphQL, OAuth and OIDC, multi-tenant SaaS architectures)
• Based in the United States with current authorization to work here
• Proven ability to write penetration test reports for both engineering and auditor audiences
• A redacted sample report demonstrating your writing quality (required as part of application)
• Two professional references who can speak to your technical testing work

Preferred qualifications:

• Mobile application testing experience using MASVS and MASTG frameworks
• Cloud penetration testing on AWS, Azure or GCP
• Published security research, custom tooling development, or responsibly disclosed vulnerabilities
• Offensive security certifications (valued but do not replace a verifiable engagement record)

How We Work With You

When you apply through Get A Job.ai, one of our recruiters will review your background and sample report, then conduct an initial screening call. If there's a strong match, we'll submit your profile to our client for consideration. Please do not contact the client directly—all communication and coordination will flow through our team to ensure a smooth process for everyone involved.

Pay

Compensation for this contract role is structured per engagement. A typical engagement spans five to ten testing days plus retest work. Specific rate details will be discussed during the screening process based on your experience level and the scope of individual engagements.

Get A Job.ai is an equal opportunity recruiter. We welcome applications from candidates of all backgrounds and do not discriminate on the basis of race, color, religion, sex, national origin, age, disability, veteran status, or any other protected characteristic.