Web Application Penetration Testing Engineer

Salary: ₱80,000 – ₱100,000 per month

About the role

We are seeking a highly technical Senior Web Application Penetration Testing Engineer to perform deep offensive security testing of complex web applications and APIs. This is a hands-on role focused on identifying vulnerabilities that conventional automated testing frequently misses, including business-logic flaws, authorization bypasses, privilege escalation paths, API abuse, and multi-step attack chains. A major component of the role is the practical use of approved offensive AI technologies to augment penetration testing. The engineer will apply AI-assisted techniques to accelerate reconnaissance and application analysis, develop and prioritize vulnerability hypotheses, identify promising attack paths, correlate findings, and improve the depth and coverage of expert-led manual testing.

Key responsibilities

• Perform full-scope penetration testing of customer-facing and internal web applications, APIs, and supporting services

• Conduct threat modeling and analyze application architecture, trust boundaries, authentication mechanisms, authorization models, APIs, data flows, and critical business workflows

• Perform deep manual security testing that goes well beyond automated scanners and standard vulnerability checklists

• Identify and exploit complex vulnerabilities, including broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business-logic abuse, injection, API authorization failures, privilege escalation, server-side validation failures, and multi-step attack chains

• Develop reproducible proofs-of-concept that clearly demonstrate technical and business impact

• Test with multiple identities, roles, privilege levels, and workflow states to expose authorization and process-control weaknesses

• Leverage approved offensive AI technologies and LLM-based security tooling throughout the penetration-testing lifecycle

• Use AI to assist with reconnaissance, attack-surface analysis, endpoint and API analysis, test-case generation, vulnerability hypothesis development, and attack-path identification

• Independently validate AI-generated findings and construct reproducible proofs-of-concept before reporting them

• Produce high-quality reports with executive summaries, technical analysis, clear reproduction steps, supporting evidence, risk context, and actionable remediation guidance

Requirements:

• 5+ years of hands-on application security or penetration-testing experience, with substantial experience testing web applications and APIs

• Advanced understanding of HTTP, browsers, authentication, authorization, session management, REST APIs, OAuth 2.0, OpenID Connect, and modern web architectures

• Demonstrated ability to discover business-logic and authorization vulnerabilities through manual analysis rather than relying primarily on scanners

• Advanced hands-on experience with Burp Suite Professional and related offensive-security tooling

• Strong knowledge of the OWASP Web Security Testing Guide, OWASP Top 10, and OWASP API Security Top 10

• Ability to manually analyze and manipulate HTTP/API requests, parameters, tokens, headers, cookies, payloads, and application state

• Ability to develop scripts or lightweight tooling in Python, JavaScript, PowerShell, Bash, or an equivalent language

• Demonstrated hands-on experience using LLMs or AI-assisted security technologies in offensive-security workflows

• Ability to combine AI reasoning with expert manual penetration testing rather than treating AI output as authoritative

• Strong technical writing and communication skills, including the ability to explain complex exploitation paths to technical and executive audiences