Cybersecurity Penetration Testing Engineer Application & API Security

Key Responsibilities:

1. Penetration Testing & Vulnerability Assessment

• Perform manual and automated penetration testing on web, mobile, and API endpoints.
• Use Burp Suite Professional extensively for intercepting, modifying, and exploiting HTTP/S traffic.
• Conduct source code-assisted testing when applicable to identify deeper logic flaws.
• Simulate real-world attack scenarios using OWASP Top 10, SANS 25, and API Security Top 10 frameworks.
• Identify authentication, authorization, session management, and input validation flaws.

1. API Security Testing

• Perform REST and GraphQL API penetration testing, including JWT, OAuth, and token manipulation.
• Validate business logic vulnerabilities and parameter tampering across microservices.
• Use tools such as Postman, Burp Suite, and OWASP ZAP for fuzzing, interception, and payload injection.
• Validate API schema misconfigurations, rate limiting, and data exposure issues.

1. Offensive Security & Exploitation

• Execute custom payloads and exploits to demonstrate risk severity to stakeholders.
• Develop proof-of-concept (PoC) exploits to validate identified vulnerabilities.
• Emulate attacker tactics, techniques, and procedures (TTPs) from MITRE ATT&CK and CWE references.

Perform targeted assessments on authentication bypass, privilege escalation, and input deserialization