Mobile and Web/Applications Penetration Testing Consultant (Mid-Level)

CAPVALUE CYBER SECURITY is expanding its Offensive Security team and is looking for a confirmed Web/Application Penetration Testing Consultant to handle high-value application audit engagements. You will work on demanding environments — e-banking platforms, financial applications, critical business portals — where technical rigor and report reliability are non-negotiable. On a day-to-day basis, you will conduct application penetration tests in black-box, grey-box, and white-box modes, covering the full OWASP Top 10 scope: injections (SQL, NoSQL, SSTI, XXE), broken access control, authentication and session management flaws, security misconfigurations, business logic weaknesses, and IDOR. Each engagement is approached with a real-impact mindset — no simple automated scanning, but reasoned exploitation designed to demonstrate actual risk to the client. You will also conduct REST and GraphQL API audits (schema analysis, fuzzing, authorization testing, business flow abuse) as well as mobile audits on Android and iOS platforms, combining static and dynamic analysis. Your daily toolkit includes Burp Suite Pro, Postman, ffuf, MobSF, and a complementary arsenal tailored to each engagement context. Every mission results in a structured audit report: precise vulnerability documentation, reproducible proof-of-exploitation, criticality assessment based on business context, and remediation recommendations tailored to both technical teams and management. Written clarity is as important as technical depth. You will actively contribute to CAPVALUE CYBER SECURITY's cyber range by helping design realistic application attack scenarios — vulnerable web labs, API environments, mobile challenges — used in our training programs and client exercises. You will also collaborate with the Red Team on combined engagements blending application intrusion and infrastructure lateral movement, enriching the tactical coverage of our offensive missions.