Penetration Tester

Freelance Application Penetration Testers | 100% remote | 12 months | European based

My client’s AppSec team is responsible for securing a portfolio of around 400 products and needs external support to test them. We’re looking for freelance pen testers to join the team remotely and work through the portfolio in a structured, prioritised way.

Responsibilities

• Plan and run penetration tests on web applications, covering the OWASP Top 10, authentication and session management, access control, business logic flaws and API security (REST/SOAP)
• Test desktop applications (thick clients), including local storage, traffic interception, DLL hijacking, privilege escalation and insecure communication with back-end services
• Carry out black box and grey box testing, depending on the product
• Manually validate findings rather than relying on scanner output alone
• Rate vulnerabilities using CVSS and write clear reports with practical remediation guidance
• Present findings to product owners and developers, and retest fixes

Requirements

• Proven hands-on application pen testing experience at mid level
• A recognised certification: OSCP, PNPT, BSCP, eCPPT or similar
• Strong command of Burp Suite and common tooling (Nmap, sqlmap, ffuf, Postman)
• Solid understanding of HTTP, web technologies and authentication protocols (OAuth, SAML, JWT)
• Experience testing thick client / desktop applications
• Clear, structured report writing
• English first language

Nice to have

• Mobile application pen testing (Android/iOS, MobSF, Frida)
• Scripting (Python, Bash, PowerShell)
• Experience in regulated industries

The details

• Fully remote, Europe-based
• Romania based is a nice to have
• 4 or 5 days per week
• Interviews taking place next week
• Start ASAP

If you are interested please send over your CV and I will give feedback as soon as possible.