Senior Offensive Security Engineer - IT Banking
Summary
Senior offensive security engineer doing full-scope manual penetration testing of web apps and APIs for a banking-focused team — exploiting IDOR/BOLA and business-logic flaws, scaling testing with Python and LLM-driven automation, and mentoring developers on remediation.
Salary: ₱100,000 – ₱150,000 per month
Key Responsibilities
Manual Pen Testing: Perform full-scope testing on web apps/APIs to exploit authorization flaws (IDOR/BOLA), business-logic vulnerabilities, and multi-step attack chains.
Offensive AI & Automation: Use LLMs for recon, threat modeling, and test generation. Build Python scripts and AI workflows to scale testing depth.
Validation & PoCs: Validate AI-generated hypotheses to eliminate false positives and build reproducible proofs-of-concept proving real risk.
Remediation & Mentorship: Partner with developers to demonstrate attack paths, support remediation, mentor team members, and fix systemic flaws.
Qualifications & Requirements
Experience: 5+ years in app security/pen testing with deep web app and API focus.
Technical Mastery: OWASP Top 10, OWASP API Top 10, Burp Suite Pro, HTTP/APIs, OAuth 2.0/OIDC, and manual request manipulation.
Scripting & AI: Python proficiency (required for tooling) plus practical experience integrating AI/LLMs into offensive workflows.
Nice-to-Haves: Fintech background, cloud white-box testing, or certs (OSWE, GWAPT, BSCP, OSCP).
