API Penetration Tester

Location: India

Work Model: Remote / Offshore

Experience: 4 8 Years

Engagement: Contract / Project-Based

Job Summary

We are looking for an experienced API Penetration Tester to support a cybersecurity project for a Canadian public-sector client.The ideal candidate should have strong hands-on experience in API and web application security testing, especially manual penetration testing.

Responsibilities

The candidate will test APIs for security vulnerabilities, review authentication and authorization controls, identify business-logic issues, validate findings, and prepare clear technical reports.

The role will include testing REST APIs, user roles, tokens, API keys, access controls, data exposure, input validation, and other common API security risks.

The candidate will also participate in remediation validation after identified issues are fixed.

Required Skills

Strong experience with

• API and Web Application Penetration Testing
• OWASP API Security Top 10
• Burp Suite
• Postman
• Swagger / OpenAPI
• JWT, OAuth 2.0 and API authentication
• Authorization and privilege escalation testing
• Business-logic testing
• Vulnerability validation and reporting

Experience with Python, Nmap, OWASP ZAP, Azure, AWS, or API gateways is an added advantage.

Experience

Candidates should have 4 - 8 years of cybersecurity experience, with strong hands-on experience in application or API penetration testing.

Experience working with enterprise, government, financial, healthcare, or other regulated clients is preferred.

Certifications

Certifications such as OSCP, eWPT, Burp Suite Certified Practitioner, CEH, GPEN, or GWAPT are preferred but not mandatory.

Communication

The candidate should have good written and verbal English communication skills and be comfortable joining occasional meetings with Canadian client teams.

Important

This is a hands-on penetration-testing role.

Candidates whose experience is mainly running automated vulnerability scanners without strong manual testing experience may not be suitable.