Referso Jobs

Senior Penetration Tester API, Web & Cloud – Contract (all genders)

Distribusion Technologies · Posted Oct 27, 2026

Remote
Remote
Contract · Senior
5+ years

Apply with RefersoAI Apply on careers page

Lead hands‑on penetration testing of public partner‑facing booking APIs, payment flows, web and mobile apps, and cloud infrastructure for a global travel tech platform.

Compensation

You will get a competitive salary.

Responsibilities

Test partner‑facing booking APIs against the OWASP API Security Top 10
Assess API authentication and integrity end to end, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing
Hunt for business‑logic abuse in booking, checkout, payment and refund flows
Run authenticated tests of traveller‑, partner‑ and operator‑facing web and mobile apps following OWASP WSTG and ASVS
Review cloud, Kubernetes and CI/CD configurations and secrets handling for attack paths

Requirements

Nice to have: OSCP
Nice to have: OSWE
Nice to have: BSCP
Nice to have: PCI‑DSS
Nice to have: LLM red‑team

Skills

penetration testing OWASP API Security Top 10 OWASP WSTG OWASP ASVS OAuth 2.0

Lead Security Engineer

Lead Security Engineer

Responsibilities

Requirements

Skills

Senior Penetration Tester API, Web & Cloud – Contract (all genders)

Compensation

Responsibilities

Requirements

Skills

IDOR jobs

Responsibilities

Requirements

Skills

Compensation

Responsibilities

Requirements

Skills