OverviewThis position supports a confidential client, a U.S.-based digital financial institution. The successful candidate will be assigned full-time to the client’s cybersecurity organization. The client is building an AI-native security organization that moves at the speed of the business. Our customer-facing and internal web applications and APIs carry financial data, customer information, and transaction workflows where subtle authorization and business-logic flaws have real consequences. We are looking for a Senior Offensive Security Engineer who will perform deep manual testing of these applications, amplified by approved offensive AI technologies.Role mandate: use elite manual web and API penetration-testing expertise, amplified by approved offensive AI technologies, to discover, validate, and clearly communicate exploitable vulnerabilities that conventional testing misses.This is not a scan-and-report role. AI does not replace hands-on exploitation: you will independently validate every AI-generated hypothesis, eliminate false positives, and demonstrate that significant findings are reproducible and exploitable.  ResponsibilitiesWeb Application & API Penetration Testing

Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services.

Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, data flows, and critical business workflows.

Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists.

Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business-logic abuse, injection, API authorization failures, privilege escalation, server-side validation failures, and multi-step attack chains.

Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process-control weaknesses.

Develop reproducible proofs-of-concept that clearly demonstrate technical and business impact, and distinguish exploitable issues from scanner noise, environmental artifacts, and low-value findings.

 Offensive AI & AI-Assisted Testing

Leverage approved offensive AI technologies and LLM-based security tooling throughout the penetration-testing lifecycle: reconnaissance, attack-surface analysis, endpoint and API analysis, test-case generation, vulnerability hypothesis development, and attack-path identification.

Apply AI-assisted analysis to identify unusual behavior, authorization inconsistencies, business-logic weaknesses, and potential multi-step exploitation paths.

Use AI to prioritize high-value targets and testing scenarios so expert effort is concentrated where meaningful findings are most likely.

Combine AI-generated hypotheses with expert manual analysis using Burp Suite Professional and custom testing utilities, and independently validate every AI-generated finding with a reproducible proof-of-concept before reporting it.

Use AI to correlate findings across applications and identify recurring vulnerability patterns or systemic weaknesses.

Develop reusable prompts, Python scripts, agents, API integrations, and workflows that increase testing speed, consistency, depth, and coverage.

Document AI-assisted testing sufficiently to establish repeatability, material human oversight, and the basis for significant conclusions.

 Reporting, Remediation & Program Improvement

Produce high-quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance.

Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting.

Identify recurring vulnerability patterns and architectural weaknesses across applications and recommend systemic corrective actions.

Improve penetration-testing methodology, tooling, reporting standards, and test coverage.

Lead technical knowledge-sharing sessions and provide peer review and mentoring on advanced exploitation techniques and finding quality.

Operate within authorized scope, rules of engagement, data-handling requirements, and approved AI usage control

5+ years of hands-on application security or penetration-testing experience, with substantial experience testing web applications and APIs.

Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures.

Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners.

Advanced hands-on experience with Burp Suite Professional and related offensive-security tooling.

Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10.

Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state.

Ability to develop scripts or lightweight tooling in Python (strongly preferred), JavaScript, Bash, or an equivalent language.

Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences.

Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows, combining AI reasoning with expert manual testing rather than treating AI output as authoritative.

Experience building or modifying Python-based security automation, API integrations, prompt workflows, or agentic testing capabilities, with practical prompt-engineering and context-engineering skills for security analysis.

Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses, and the ability to validate AI-generated findings through manual testing and reproducible proofs-of-concept.

Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.

Preferred

Experience performing penetration testing in financial services or another regulated industry, including complex transactional applications where authorization or business-logic failures can affect financial data, customer information, or transaction integrity.

Experience testing cloud-native, API-heavy, microservices, and modern identity-based architectures.

Experience with source-assisted or white-box penetration testing and secure code review.

Familiarity with CI/CD pipelines, DevSecOps practices, and modern software-development environments.

Hands-on certifications such as OSWE, GWAPT, BSCP, OSCP, or an equivalent demonstration of advanced capability.