Title: Cybersecurity Penetration Testing Engineer Application & API Security
Location: Charlotte, NC
Job Summary
We are seeking a Cybersecurity Penetration Testing Engineer specializing in Application and API Security to perform advanced offensive security testing across business-critical systems.
The ideal candidate will have hands-on expertise with Burp Suite Professional , deep knowledge of offensive security methodologies, and the ability to identify, exploit, and communicate vulnerabilities effectively.
You will collaborate closely with development, DevSecOps, and risk teams to embed secure coding practices and support remediation efforts within the Secure SDLC .
Experience Required
5 8 years of total experience in web, mobile, or API penetration testing
Minimum 3+ years of hands-on experience in offensive security testing
Key Responsibilities
1. Penetration Testing & Vulnerability Assessment
Conduct manual and automated penetration tests on web, mobile, and API applications.
Leverage Burp Suite Professional for intercepting, modifying, and exploiting traffic.
Perform source code assisted testing to uncover deep logic flaws.
Simulate real-world attack scenarios aligned with OWASP Top 10, SANS 25, and API Security Top 10 frameworks.
Identify vulnerabilities in authentication, authorization, input validation, and session management.
2. API Security Testing
Perform penetration testing of REST and GraphQL APIs, including JWT/OAuth/token testing.
Validate logic flaws, parameter tampering, and insecure microservice communication.
Utilize tools such as Postman, Burp Suite, and OWASP ZAP for fuzzing and payload injection.
Assess API schema issues, rate limiting, and sensitive data exposure.
3. Offensive Security & Exploitation
Develop and execute proof-of-concept (PoC) exploits to demonstrate impact.
Simulate attacker TTPs following the MITRE ATT&CK and CWE frameworks.
Perform targeted testing for authentication bypass, privilege escalation, and deserialization flaws.
Demonstrate advanced exploitation techniques to enhance vulnerability validation.
4. Reporting & Remediation Support
Produce detailed technical reports with clear risk ratings, reproduction steps, and mitigations.
Collaborate with engineering and DevSecOps teams to support patching and secure code remediation.
Participate in vulnerability triage, retesting, and remediation validation cycles.
Present results to both technical teams and executive stakeholders in clear, actionable terms.
5. Security Process & Continuous Improvement
Integrate testing results into CI/CD pipelines to enable DevSecOps automation .
Contribute to secure coding guidelines and developer training initiatives.
Stay up to date with emerging attack trends, new CVEs, and offensive tools.
Develop internal scripts, extensions, or automation workflows to improve testing efficiency.
Technical Skills
Core Tools & Techniques
Expert-level proficiency in Burp Suite Professional (Intruder, Repeater, Decoder, Extender).
Familiarity with OWASP ZAP, Nmap, Metasploit, SQLmap, DirBuster, Hydra, Ffuf .
Deep understanding of OWASP Top 10 (Web & API) and CWE Top 25 vulnerabilities.
Strong analytical skills to identify logic-based and authentication-related flaws.
Programming & Scripting
Proficient in at least one scripting language: Python, JavaScript, or Bash .
Ability to write custom scripts or Burp extensions for advanced payloads.
Strong understanding of REST, GraphQL, JSON, and XML protocols.
Offensive Security
Hands-on experience in vulnerability exploitation, reverse engineering, or red team engagements .
Familiarity with exploit frameworks and C2 tools (e.g., Cobalt Strike, Empire) is a plus.
Ability to emulate APT-style threat actor behavior .
API / Cloud Security (Preferred)
Knowledge of API gateways (Kong, Apigee) and microservices architectures .
Exposure to cloud-native security testing (AWS, Azure, GCP) and container security (Docker/Kubernetes).
Qualifications
Bachelor s or Master s degree in Computer Science, Cybersecurity, or related field
5 8 years of experience in application or API penetration testing
Strong technical writing and presentation skills for diverse audiences
Preferred Certifications
OSCP / OSWE / OSEP (Offensive Security)
Burp Suite Certified Practitioner (BSCP)
eWPTX / eCPPT / CEH (Practical)
GWAPT / GPEN / GCPN
...The Infusion Nurse is responsible for the safe initiation, administration, monitoring, and discontinuation of infusion therapies. This role encompasses the provision of direct patient care, patient and family education, and ongoing evaluation of clinical outcomes. The...
...ground running. *****Notary is required and Livescan is preferred. COT certification is a WOW to have.Previous experience at The UPS Store is required. There is lots of growth potential. This is not a job, it's going to be a career. This is a level 2 position.RESPONSIBILITIES...
About Blue Cross and Blue Shield of Minnesota At Blue Cross and Blue Shield of Minnesota, we are committed to paving the way for everyone to achieve their healthiest life. We are looking for dedicated and motivated individuals who share our vision of transforming...
...the C&S Wholesale Grocers family of companies, SpartanNash is a food solutions company that delivers the ingredients for a better life... ...distributor, wholesaler and retailer with a global supply chain network, SpartanNash distributes grocery and household goods, including...
...Schedule is 6am - 4pm Tu - Fr. Please see the full job description for the position here:... ...Shift Lead_Trainer. This position is full-time (40 hours per week) with a comprehensive... ...low-deductible medical insurance, with up to 80% of health insurance paid for by the...