Senior Application Security Engineer (Penetration Testing & Offensive AI)

Salary: ₱85,000 – ₱100,000 per month

Key Responsibilities

Web Application & API Penetration Testing

• Perform comprehensive penetration testing on web applications, APIs, and supporting services.

• Conduct threat modeling and assess application architecture, authentication, authorization, data flows, and business processes.

• Identify and validate complex security vulnerabilities, including access control issues, IDOR/BOLA/BFLA, injection flaws, privilege escalation, and business logic weaknesses.

• Perform advanced manual security testing beyond automated vulnerability scanning.

• Develop reproducible proof-of-concept demonstrations to assess security risks and business impact.

• Evaluate security issues across different user roles, access levels, and application workflows.

Offensive AI & AI-Assisted Security Testing

• Utilize approved AI-assisted security tools and Large Language Models (LLMs) to support penetration testing activities.

• Apply AI technologies for reconnaissance, vulnerability analysis, test-case development, and attack-path identification.

• Combine AI-assisted findings with manual testing using Burp Suite Professional and other security tools.

• Independently validate AI-generated findings to ensure accuracy and eliminate false positives.

• Develop Python scripts, automation tools, and AI-assisted workflows to improve testing efficiency and coverage.

• Ensure responsible handling of sensitive information and compliance with approved AI security practices.

Security Reporting & Collaboration

• Prepare detailed penetration testing reports, including identified vulnerabilities, risk assessments, supporting evidence, and remediation recommendations.

• Collaborate with development and engineering teams to resolve security vulnerabilities and conduct retesting.

• Identify recurring security weaknesses and recommend improvements to application security.

• Enhance penetration testing methodologies, tools, and security assessment processes.

• Provide technical guidance, knowledge sharing, and support to other security team members.

• Ensure all security testing activities comply with authorized testing scope, security policies, and data protection requirements.

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience.

• At least 5 years of hands-on experience in Application Security or Penetration Testing, particularly in web applications and APIs.

• Strong knowledge of HTTP, REST APIs, authentication, authorization, session management, OAuth 2.0, and OpenID Connect.

• Proven experience in manual penetration testing, vulnerability exploitation, and identifying complex business logic and access control issues.

• Advanced experience with Burp Suite Professional and other penetration testing tools.

• Strong understanding of OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide.

• Experience analyzing HTTP requests, API parameters, authentication tokens, headers, and application security controls.

• Knowledge of scripting and automation using Python, JavaScript, PowerShell, Bash, or similar languages.

• Strong analytical, problem-solving, technical documentation, and communication skills.

Required Offensive AI Experience

• Hands-on experience using AI-assisted security tools or Large Language Models (LLMs) in penetration testing or offensive security activities.

• Ability to integrate AI-assisted analysis with manual penetration testing and independently validate security findings.

• Experience developing Python-based security automation, AI-assisted workflows, API integrations, or prompt-based testing tools.

• Understanding of AI limitations, including false positives, hallucinations, and inaccurate vulnerability assessments.

• Knowledge of prompt engineering and AI-assisted security analysis.

• Ability to maintain data confidentiality and follow security standards when using AI technologies.

Preferred Qualifications

• Experience in penetration testing within banking, financial services, or other regulated industries.

• Knowledge of security testing for financial transactions, customer information, and complex business applications.

• Experience with cloud-native applications, microservices, API security, and modern authentication architectures.

• Familiarity with secure code review, white-box testing, CI/CD pipelines, and DevSecOps practices.

• Relevant certifications such as OSWE, GWAPT, BSCP, OSCP, or equivalent hands-on security expertise.