Penetration Tester

Job Title: API Penetration Tester – EU Interoperability PlatformLocation: Fully RemoteStart Date: ASAPRate: Competitive (submit your rate)EU Citizenship is MandatoryFully remote. Immediate start. We need a sharp Penetration Tester to tear apart an EU-wide data exchange platform. This is not a standard web app pentest – it is an API-first, White-box assessment of a complex H2M/M2M interoperability solution. Your mission: break the authentication, abuse the APIs, and find the flaws before go-live. No changes after your test, so your findings matter. What You Will Test

• Upload Portal (Angular) – file uploads, user authentication- Kong Enterprise (API Gateway) – routing, policy enforcement- Data Platform (Cloudera/Java) – data ingestion, processing, storage

Key focus: API security. dpRead and dpWrite endpoints. Payload manipulation, parameter injection, business logic flaws. Authentication: ADFS (OIDC), JWT tokens, AD group RBAC, x.509 certificates for M2M flows. --- What You Bring

• 6+ years in penetration testing (API security is your thing)- OAuth2, OIDC, JWT, x.509 – you know them inside out- REST API testing – you break APIs for fun- Kong or similar API Gateway experience- White-box testing – you read code and find the edge cases- EU citizenship (mandatory)- OSCP (or equivalent) preferred- C#, Java, or Angular knowledge is a bonus

--- The Details

• Fully remote- Start: ASAP- Duration: TBC (scoping in progress)- Rate: Submit your daily rate

--- Apply Send your CV, a quick intro, and your rate. Let's go.