Senior Penetration Tester Needed for Threat Model Review

Cascade Apps

Contract · Remote · Flexible hours

About the role

Cascade Apps is building a unified integration layer called "FusionGate" that connects its billing platform, CRM, and internal APIs. As a Senior Penetration Tester you will secure this critical middleware, ensuring that data flows between systems remain confidential and tamper‑proof throughout the short‑term engagement.

Key responsibilities

• Perform black‑box testing of the FusionGate API endpoints using Burp Suite and OWASP ZAP.
• Identify and exploit authentication flaws in the OAuth2 flow linking billing and CRM services.
• Conduct network‑level assessments of the internal API mesh with Nmap and Nessus.
• Create detailed exploit scripts in Python to demonstrate privilege escalation paths.
• Deliver a remediation report with prioritized fixes before the two‑month deadline.

Must-have skills

• 5+ years hands‑on penetration testing of web services and APIs.
• Proficiency with Burp Suite, OWASP ZAP, and Metasploit.
• Strong Linux command‑line expertise and scripting in Python.
• Experience securing OAuth2 and JWT implementations.
• Ability to produce clear, actionable security findings.

Nice to have

• Familiarity with CI/CD pipeline security scanning tools.
• Previous work on financial or billing systems.