Senior Offensive Security Tester

What you'll do

Run ongoing offensive testing across web applications, APIs, internal networks and cloud configurations,

closing the gaps between annual pen tests and one-off engagements

Target policy administration, claims processing and customer/agent portals, with emphasis on business-logic

flaws such as rate manipulation, claims fraud vectors and authorization bypass

Build and maintain custom exploit and test tooling tailored to the client's tech stack, reducing reliance on

generic scanners

Validate and document findings with clear reproduction steps, severity and business impact

Feed findings into a remediation-tracking loop with engineering and retest fixes to shorten time-to-fix on

critical vulnerabilities

Work with the GRC team to translate findings into risk-register entries

Requirements

6+ years in offensive security, penetration testing or red teaming

Deep hands-on experience with web app and API testing (OWASP Top 10, OWASP API Top 10), internal

network exploitation and Active Directory attacks

Cloud security testing experience in AWS and/or Azure (IAM misconfigurations, exposed services, privilege

escalation)

Proficiency with Burp Suite Pro, Metasploit, BloodHound, Nmap and similar tools

Scripting and tool development in Python, Go, PowerShell or similar

Strong written English for technical reports and executive summaries

Overlap with U.S. business hours

Nice to have

OSCP, OSEP, OSWE, GPEN, GWAPT or CRTO

Experience in insurance, financial services or healthcare

Exposure to mainframe or legacy core insurance platforms