MHMarkets
Penetration Tester (Web & API) MHMarkets
About the role
Conduct manual penetration testing of web applications, REST/GraphQL APIs, and WebSockets.
Identify vulnerabilities aligned with OWASP Top 10 and OWASP API Security Top 10.
Test financial and trading-specific business logic, including transaction manipulation, race conditions, authorization flaws, price manipulation, and session-related vulnerabilities.
Perform vulnerability exploitation and validation using Burp Suite and other offensive security tools.
Develop custom scripts and techniques to identify vulnerabilities that automated scanners may miss.
Assess authentication, authorization, session management, input validation, API security, and transaction flows.
Produce detailed penetration testing reports with reproducible steps, risk ratings, business impact, and practical remediation recommendations.
Work closely with Development, DevSecOps, and Infrastructure teams to validate vulnerability remediation.
Conduct retesting to ensure identified vulnerabilities have been properly resolved.
Support continuous improvement of application security testing methodologies and security controls.
Ensure security testing activities are conducted with minimal impact on trading systems and business operations.