Senior Penetration Tester, Sitecore

• 3+ years of hands‑on penetration testing experience focused on web applications and APIs (not general security testing)
• One or more offensive security certifications (e.g., e.g., OSCP, OSWE, CWEE, GWEB, GWAPT or equivalent) demonstrating practical exploitation skills
• Strong proficiency with Burp Suite and modern web/API exploitation techniques
• Ability to clearly communicate findings and coach engineering teams on secure fixes and prevention
• Strong analytical mindset and ability to reason about realistic attack paths in cloud‑native, multi‑tenant systems

Desirable

• As a Senior Penetration Tester (Web/API & Agentic/MCP), you will conduct authorized penetration testing across Sitecore’s SaaS platforms, APIs, and AI/agent‑driven services to identify and eliminate exploitable weaknesses prior to release. You will also act as a trusted security partner to engineering teams, advising on secure design, testing decisions, and risk remediation
• Perform authorized web application and API penetration testing on Sitecore products, focusing on auth/authz, business‑logic abuse, IDOR/BOLA, SSRF, XSS and other injection flaws and multi‑tenant isolation failures common in SaaS platforms
• Conduct deep API security testing across REST/GraphQL, including OAuth 2.0 / OIDC flows, JWT handling, audience/scope validation, and permission‑model abuse
• Execute agentic / MCP penetration testing, including tool‑abuse scenarios, prompt‑to‑action exploit chains, cross‑tool data exfiltration paths, and validation of agent workflows invoking internal services
• Use Burp Suite as the primary manual testing tool for custom attack flows, protocol‑level manipulation, and WAF bypass where applicable
• Apply white‑box or hybrid testing when needed by reviewing mainly C# / ASP.NET Core source code to identify untrusted data flows (sources → sinks) and then dynamically confirm exploitability through real request execution
• Test cloud-native attack paths in containers / Pods / Kubernetes, including container escape / “escape to host” and cluster misconfiguration exploitation where relevant
• Produce clear, actionable reports with PoCs, reproducible steps, impact assessment, and concrete remediation guidance, and support teams through fix validation and retesting