Web Application Penetration Testing Engineer - AI

Web Application & API Penetration Testing Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services. Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, APIs, data flows, and critical business workflows. Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists. Offensive AI & AI-Assisted Testing Leverage approved offensive AI technologies and LLM-based security tooling throughout the penetration-testing lifecycle. Use AI to assist with reconnaissance, attack-surface analysis, endpoint and API analysis, test-case generation, vulnerability hypothesis development, and attack-path identification. Apply AI-assisted analysis to identify unusual behavior, authorization inconsistencies, business-logic weaknesses, and potential multi-step exploitation paths. Develop reusable prompts, Python scripts, agents, API integrations, or workflows that increase testing speed, consistency, depth, and coverage. Reporting, Remediation & Program Improvement Produce high-quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance. Work directly with application and engineering teams to explain weaknesses, demonstrate attack paths, support remediation, and perform retesting. Required Qualifications 5+ years of hands-on application security or penetration-testing experience, with substantial experience testing web applications and APIs. Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures. Advanced hands-on experience with Burp Suite Professional and related offensive-security tooling. Ability to develop scripts or lightweight tooling in Python, JavaScript, PowerShell, Bash, or an equivalent language. Required Offensive AI Experience Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows. Ability to combine AI reasoning with expert manual penetration testing rather than treating AI output as authoritative. Experience building or modifying Python-based security automation, API integrations, prompt workflows, or agentic testing capabilities. Strong understanding of AI limitations, including hallucinations, false positives, incomplete context, unsafe recommendations, and incorrect exploitation hypotheses. Ability to protect sensitive application data, credentials, source code, requests and responses, architecture information, and vulnerability data when using approved AI systems.