Senior Web Application Penetration Testing Engineer

About us

Our professional firm boasts over 70 years of experience and is ranked 5th nationally and 9th globally as part of Crowe Global, a network of over 769 offices in 129 countries worldwide. Our prestige, with 19 offices in Mexico, is built on experience, reputation, and the quality of our Audit, Tax, and Consulting solutions, among others. We provide the best advice so our clients can make smart decisions!

Join our team as: Senior Web Application Penetration Testing Engineer & Offensive AI

What are we looking for?

We are seeking a senior security professional with strong hands- on expertise in web application and API penetration testing, combined with AI-assisted security automation. The ideal candidate can identify and validate complex vulnerabilities trough deep manual testing and leverage Python and AI-driven tools to improve testing efficiency, coverage, and accuracy.

Key Responsabilities

• Perform in – depth manual penetration testing testing of web applications, REST APIs, and supporting services.
• Identify and validate complex vulnerabilities, including broken access control, authentication weaknesses, business logic flaws, injection, and privilege escalation.
• Analyze application architecture, authentication mechanisms, authorization models, and data flows to identify exploitable security weaknesses.
• Use Burp Suite and other security testing tools to manipulate requests, validate findings, and develop reproducible proofs of concept.
• Leverage approved AI and LLM-based tools to support reconnaissance, vulnerability analysis, test case generation, and attack path identification.
• Develop and improve Python scripts, prompts, agents, and API integrations to automate repetitive testing tasks and enhace security assessment workflows.
• Document findings clearly, communicate technical and business impact, and recommend remediation strategies.

Requiered qualifications

• 5+ years of hands- on experience in application security or penetration testing, including substantial web application ad API testing.
• Strong understanding of REST APIs, authentication, authotization, session management, and common web security vulnerabilities.
• Practical experience performing manual penetration testing beyond automated scanners and standard vulnerability checks.
• Strong knowledge of the OWASP Web Security Testing Guide and common application security risks.
• Hands-on experience using Burp Suite or equivalent web application security testing tools.
• Experience writing or modifying Python scripts for security testing or automation.
• Abillity to validate vulnerabilities, develop proofs of concept, and communicate technical findings effectively.

Preferred Qualifications

• Experience using AI-assisted security testing tools, LLM-based security workflows, or offensive security agents.
• Experience developing reusable prompts, automation scripts, or API integrations for penetration testing.

What do we expect from you?

• We are looking for a detailed- oriented, analytical professional with strong problem-solving skills and hands- on approach security testing
• Strong leadership, communication, and team development skills.

What do we offer?

• Attractive and competitive salary, determined based on the candidate's experience and executive skills and benefits
• Remote position
• Job stability and an excellent corporate work environment.
• Growth opportunity and career plan continue within a top-tier global firm.