Application Security Engineer / Penetration tester

Growe is a company seeking an Application Security Engineer / Penetration Tester to strengthen the security of its applications and APIs. The role focuses on triaging security findings, conducting code reviews and penetration tests, and auditing web applications and REST and GraphQL APIs for vulnerabilities, authentication issues, authorization flaws, and business logic risks.

Responsibilities:

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools, filter out false positives, assess risks, and track issues through to remediation
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities, logic flaws, and insecure implementation choices before code reaches production
• Perform hands-on penetration testing of web applications, microservices, and APIs to uncover security vulnerabilities and business logic flaws
• Audit REST and GraphQL APIs and web applications with a strong focus on core application security risks, authentication, authorization, and business logic

Requirements:

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing
• Hands-on experience triaging and analyzing findings from Semgrep / OpenGrep, Gitleaks, Trivy, and OSV-Scanner
• Experience with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetExec
• Deep understanding of classic OWASP Top 10 vulnerabilities, including Injection flaws (SQLi, Command Injection), Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Broken Access Control / Insecure Direct Object References (IDOR / BOLA), Security Misconfigurations, Cryptographic Failures, Insecure Deserialization, and Mass Assignment
• Solid knowledge of OWASP API Security Top 10 for REST and GraphQL architectures
• Deep understanding of identity protocols and access control mechanics (OAuth 2.0, OIDC, JWT, SAML, RBAC/ABAC)
• Ability to identify complex authorization bypasses, session management flaws, and business logic bugs
• Intermediate level of English (spoken and written)
• Ability to read and analyze modern application code to spot security flaws (will be a plus)
• Understanding of cloud security principles in AWS environments and Kubernetes (K8s) security fundamentals (will be a plus)