Api Penetration Testing

Api Penetration Testing Engineer Jobs

2 jobs found

Today

Senior Penetration Tester / Red Team Engineer

Cognizant New York, NY

New York, NY

Today

$134k - $155k/yr Full time Senior Api Penetration Testing Application Security

Apply Now

Job Description

Lead offensive security efforts to uncover exploitable weaknesses and strengthen enterprise cyber resilience through evidence-based penetration testing.

Responsibilities

Conduct comprehensive penetration testing across web applications, APIs, networks, cloud environments, mobile applications, and Windows/Linux systems.
Run vulnerability assessments using automated scanning platforms and manual testing to identify security weaknesses.
Simulate realistic adversary scenarios to evaluate authentication, authorization, access controls, network defenses, and overall security resilience.
Identify and validate vulnerabilities, misconfigurations, exposed credentials, insecure code, and potential attack paths across enterprise environments.
Use offensive security tools including Burp Suite, Metasploit, Nmap, Kali Linux, Pentera, and vulnerability scanning platforms.
Develop Python and Bash scripts, automation utilities, and custom testing approaches to improve testing efficiency and coverage.
Produce documentation covering assessment methodologies, technical evidence, risk impact, and findings, with clear remediation recommendations for stakeholders.
Collaborate with application, infrastructure, cloud, and security teams to remediate findings and validate fixes via retesting.
Research emerging threats, CVEs, OWASP vulnerabilities, exploitation techniques, and evolving offensive security methodologies.
Support security assessments, compliance initiatives, risk reviews, and continuous improvement of enterprise offensive security capabilities.

Requirements

8+ years of hands-on experience in Penetration Testing, Red Teaming, Offensive Security, or Security Engineering.
Expert-level experience delivering penetration tests across web applications, networks, APIs, endpoints, cloud platforms, and enterprise infrastructure.
Strong expertise in vulnerability exploitation, attack-path analysis, credential security, authentication testing, and security control validation.
Advanced hands-on experience with offensive security tools: Burp Suite, Metasploit, Nmap, Kali Linux, Pentera Console/Surface, and vulnerability scanners.
Strong scripting and automation skills using Python, Bash, PowerShell, or similar technologies.
Deep understanding of OWASP, CVE/CVSS, MITRE ATT&CK, network security, application security, and modern attack methodologies.
Experience working with development and infrastructure teams to provide remediation guidance and perform validation/retesting of security fixes.
Strong technical reporting skills, with the ability to communicate vulnerabilities, business impact, and remediation priorities to technical and leadership audiences.
Relevant certifications are preferred: OSCP, OSEP, OSWE, GPEN, GXPN, CRTO, or equivalent offensive security certifications.

Technologies

Burp Suite
Metasploit
Nmap
Kali Linux
Pentera
Pentera Console/Surface
Python
Bash
PowerShell
OWASP
CVE/CVSS
MITRE ATT&CK

Benefits

Medical/Dental/Vision/Life Insurance
Paid holidays plus Paid Time Off
401(k) plan and contributions
Long-term/Short-term Disability
Paid Parental Leave
Employee Stock Purchase Plan

Salary and other compensation

Annual salary: $134,000 - $154,500 per year, depending on experience and other qualifications.
Eligible for Cognizant’s discretionary annual incentive program, subject to plan terms and performance.

View full job page →

Today

Application Security Penetration Engineer

Citi Irving, TX

Irving, TX

Today

$96k - $145k/yr Full time Ai Enabled Security Ai Security Api Penetration Testing

Apply Now

Job Description

Citi is seeking an Application Security Penetration Engineer to join its Offensive Security team. The role focuses on conducting deep-dive assessments and penetration testing across a range of technologies, with an emphasis on translating findings into clear risk guidance and remediation recommendations.

Role Responsibilities

Perform manual vulnerability assessments and penetration testing across applications and/or infrastructure.
Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
Develop functional proof-of-concept code and exploit scenarios to demonstrate exploitability and tangible impact of security weaknesses.
Research and use LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities.
Find multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths that can bypass manual and traditional automated testing.
Document vulnerabilities with reproduction steps, attack chains, and risk ratings in standardized assessment reports.
Communicate assessment results to both technical and non-technical audiences.
Explain vulnerabilities to application developers, system architects, and ML engineers, including root causes and business impact.
Support remediation by outlining a defense-in-depth approach for business stakeholders.
Recommend actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers to close security gaps.
Stay current with emerging offensive security techniques and participate in threat modeling and adversarial testing across traditional and AI-driven technology stacks.
Support pentesting engagements for the firm’s critical, top-tier applications.
Research ways to automate pentest activities, including the use of AI and LLM tooling, to improve vulnerability discovery.

Required Qualifications

Minimum 1 to 3 years of hands-on experience in penetration testing, application security assessment, or software development, ideally in an enterprise environment.
Hands-on experience with dynamic, proxy, and network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk.
Exposure to AI security and adversarial testing tools including Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous.
Strong foundation in enterprise programming and scripting languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
Familiarity with common web and application framework stacks such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries.
Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads.
Deep knowledge of industry security standards, including OWASP Top 10 and CWE/SANS Top 25.
Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.

Skills and Technologies

Penetration testing and vulnerability assessment: Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, OWASP ZAP
Static analysis and software composition: Checkmarx, BlackDuck, SonarQube, Snyk
AI security and adversarial testing: Garak, PyRIT, Counterfit, Adversarial Robustness Toolbox (ART)
Programming and scripting: Python, Java, .NET/C#, C/C++, Ruby, NodeJS
Frameworks and ecosystems: Spring, AngularJS, React, Struts, ASP.NET Core
Security and standards: OWASP Top 10, CWE/SANS Top 25, OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF
Cloud platforms: GCP, AWS, Azure

Education and Certifications

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline. Equivalent professional or hands-on experience may be considered in lieu of a degree.
Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.

Benefits

Medical, dental & vision coverage
401(k)
Life, accident, and disability insurance
Wellness programs
Paid time off packages including planned time off (vacation), unplanned time off (sick leave), and paid holidays

Position Details

Location: Irving, TX (onsite)
Salary: USD 96,400 to 144,600 per year
Time Type: Full time
Job Family Group: Technology
Job Family: Information Security
Primary Location: Irving Texas, United States
Anticipated posting close date: Oct 20, 2026

View full job page →

Api Penetration Testing Engineer Jobs

Senior Penetration Tester / Red Team Engineer

Application Security Penetration Engineer

Get Api Penetration Testing Engineer Jobs alerts