# Senior Penetration Tester / Application Security Engineer — Dexis Development
Dexis Development is looking for a Senior Penetration Tester / Application Security Engineer for an upcoming European client project.
Start: Q4 2026
Format: Remote
Engagement: Project-based / part-time
Main scope: Web Application + Admin Panel + API Penetration Testing
## Project Stack
- Drupal + significant custom code
- Vue.js frontend
- Vue.js admin panel
- Java backend
- MongoDB
- React Native — iOS / Android *(mobile pentest may be added later)*
## Responsibilities
- Manual Web Application and API penetration testing
- Black-box, grey-box and white-box assessments
- Authentication / authorization / RBAC testing
- Business logic vulnerability testing
- API security testing
- Vulnerability validation and false-positive elimination
- Remediation recommendations
- Retesting after remediation when required
- Preparation of professional client-facing pentest reports
## Required Experience
- Strong experience in Web & API Penetration Testing
- Strong manual pentesting skills — not only automated scanning
- Strong knowledge of Burp Suite
- OWASP Top 10
- OWASP API Security Top 10
- OWASP Web Security Testing Guide
- PTES
- Authentication, authorization and session security
- Access-control and business logic vulnerabilities
- Experience testing complex custom web applications
- Experience preparing professional penetration testing reports
## Languages — Mandatory
- English
- Ukrainian or Russian — fluent
## Will Be a Plus
- OSCP / OSWE / CREST
- BSCP / GPEN / GWAPT or similar certifications
- Experience with EU / enterprise clients
- Java application security
- Drupal security
- Mobile / React Native pentesting
- Cloud / infrastructure pentesting
## When Applying
Please include:
- Relevant Web/API pentesting experience
- Certifications
- Location
- Availability from Q4 2026
- Hourly or daily rate
- An anonymised sample pentest report, if available