Web Application Penetration Tester

At blubank, we’re always looking for curious, capable, and driven people to join our team. As a Web Application Penetration Tester , you’ll have the opportunity to work in a fast-paced environment, take on meaningful challenges, and grow alongside a team that values learning, collaboration, and impact.

If you’re excited to build, learn, and make a difference, we’d love to hear from you.

Responsibilities:

·       Lead and execute advanced penetration testing engagements against web applications, REST APIs and web services.

·       Identify and exploit security vulnerabilities, including OWASP Top 10 risks and complex application-level security flaws.

·       Perform manual security testing.

·       Assess authentication, authorization, session management, access control, and business logic vulnerabilities.

·       Conduct security assessments of modern web architectures, including microservices, and single-page applications.

·       Perform source code reviews and identify security weaknesses in application logic and implementation.

·       Develop custom scripts and tools to automate testing activities and validate security findings.

·       Conduct advanced testing for vulnerabilities such as:

o   SQL Injection and NoSQL Injection

o   Cross-Site Scripting (XSS)

o   Server-Side Request Forgery (SSRF)

o   Remote Code Execution (RCE)

o   Insecure Direct Object References (IDOR/BOLA)

o   Authentication and authorization bypasses

o   Server-Side Template Injection (SSTI)

o   XML External Entity (XXE)

o   Business Logic Vulnerabilities

o   Insecure Deserialization

o   API Security Vulnerabilities

·       Prepare comprehensive penetration testing reports, including technical details, proof of concept, risk ratings, and remediation guidance.

·       Validate remediation activities through retesting and security verification.

·       Provide technical guidance to development teams to improve application security.

·       Stay up to date with emerging vulnerabilities, attack techniques, security research, and exploitation methodologies.

Qualifications

• Minimum 5 years of hands-on experience in web application penetration testing or application security.


• Strong understanding of HTTP/HTTPS protocols, web technologies, and application architectures.


• Advanced knowledge of OWASP Top 10 and OWASP Web Security Testing Guide (WSTG).


• Extensive practical experience with Burp Suite Professional.


• Experience testing RESTful APIs, and authentication mechanisms such as OAuth 2.0, OpenID Connect, and JWT.


• Strong understanding of common security controls, including WAFs, CSP, CORS, and secure session management.


• Experience with Linux environments, networking fundamentals, and scripting languages such as Python, Bash, or JavaScript.


• Ability to identify complex vulnerabilities through manual testing and creative attack scenarios.


• Strong report-writing, analytical, and problem-solving skills.

Preferred Qualifications

• Hands-on experience conducting Android and iOS application penetration testing, including static and dynamic analysis.


• Relevant certifications.


• Experience with source code review and secure code analysis.


• Knowledge of secure SDLC, DevSecOps, and CI/CD security integration.


• Experience in vulnerability research, exploit development, or responsible vulnerability disclosure.


• Familiarity with container security and Kubernetes application environments.

Benefits:

• Flexible working hours


• Learning, training, and professional development opportunities


• Supplementary health insurance


• Performance-based bonuses


• Employee loans


• Lunch allowance


• Team activities budget


• Military service replacement project for selected positions