Penetration Tester

Project overview

Freelance Application Penetration Testers

The Opportunity

If you're tired of short engagements that end just as you get to know the application, this one is worth reading.

This is a 12-month freelance contract working through a portfolio of around 400 products. That's a full year of booked-in work, with enough variety that no two weeks look the same.

The testing follows a structured, prioritised plan, so you're working through a clear schedule rather than firefighting.

The Role

You'll join an in-house AppSec team as external support, testing both web and desktop applications. Each product is tested black box or grey box, depending on what it needs.

Because you present directly to the people building the products and retest their fixes, you'll see your findings get resolved rather than sit in a backlog.

The Company

Our client is a large organisation with a portfolio of around 400 products and a dedicated in-house AppSec team. The team has a clear plan for working through that portfolio and is bringing in experienced freelancers to deliver it.

For you, that means a defined scope, a prioritised testing schedule and a team that understands security, so you can get straight into the work.

• Freelance contract, 12 months
• Fully remote in Europe
• 4 or 5 days per week
• Interviews next week, start ASAP
• Test web applications across the OWASP Top 10, authentication and session management, access control, business logic and REST/SOAP APIs
• Test thick client applications, including local storage, traffic interception, DLL hijacking, privilege escalation and back-end communication
• Validate findings manually rather than relying on scanner output
• Rate vulnerabilities with CVSS and write reports with practical remediation guidance
• Present findings to product owners and developers, then retest their fixes

Requirements

How to Apply

Interviews are taking place next week, so if this sounds right, get in touch now. Send your CV and you'll get feedback as soon as possible.

Your CV doesn't need to be up to date. Send what you have, or just give the MAM Gruppe team a call.

• Proven hands-on application penetration testing experience at mid level
• OSCP, PNPT, BSCP, eCPPT or an equivalent certification
• Strong Burp Suite skills, plus common tooling such as Nmap, sqlmap, ffuf and Postman
• A solid understanding of HTTP and authentication protocols including OAuth, SAML and JWT
• Experience testing thick client / desktop applications
• Clear, structured report writing in fluent English

Project details

• Start: flexible
• Remote: hybrid
• Location: Remote, Iasi, DE
• Languages: English