Role & seniority: Application Penetration Tester, Entry level (full-time)

Stack/tools: Manual application penetration testing of web apps and APIs; authenticated/unauthenticated testing; based on OWASP Web Top 10 and OWASP API Top 10; focus on business logic, IDOR/BOLA, and secure remediation guidance

Top 3 responsibilities

Perform manual testing of web applications and APIs, including authenticated flows
Identify, exploit, validate vulnerabilities; assess impact and report findings with remediation guidance
Produce technical and executive-level reports; support retesting and collaborate with developers and security teams

Must-have skills

Bachelor’s degree in CS/Info Security or related field (preferred)
Relevant application security or penetration testing experience; ability to perform manual testing beyond automated scans
Capable of passing Haumaru ASCP Lab Exam (ascp.haumaru.org)

Nice-to-haves

Experience communicating findings to non-technical stakeholders; understanding of secure remediation practices
Prior experience in offensive security/testing environments and risk-based prioritization
Location & work type: Karachi, Pakistan; full-time hybrid role with some remote work flexibility

Full Description

Company Description Haumaru Technologies Limited is a leading cybersecurity consulting firm dedicated to empowering organizations with cutting-edge digital security solutions. Through specialized subsidiaries—Haumaru Labs, Haumaru Code, and Haumaru Care—the company provides a holistic approach to cybersecurity and risk management. Haumaru Technologies focuses on safeguarding sensitive data, ensuring regulatory compliance, and protecting against evolving cyber threats. The organization is committed to delivering robust and tailored solutions to businesses worldwide.

Role Description This is a full-time hybrid role for an Application Penetration Tester based in Karachi, with the flexibility of some remote work. We are seeking a skilled and detail-oriented Application Penetration Tester to join our offensive security team. The role focuses on identifying, validating, and reporting security vulnerabilities in web applications and APIs, with an emphasis on real-world exploitation, business logic testing, and secure remediation guidance.

The successful candidate will work closely with application owners, developers, and security stakeholders to assess application security posture and support remediation efforts in line with industry best practices and client requirements.

Perform manual application penetration testing against web applications and APIs Conduct authenticated and unauthenticated testing across application workflows Identify and exploit vulnerabilities aligned with OWASP Web Top 10 and OWASP API Top 10 Test for business logic flaws, authorization bypasses, and IDOR/BOLA issues Review API endpoints for authentication, authorization, input validation, and data exposure weaknesses Analyze application behavior, request/response flows, and client–server interactions Validate findings, assess impact, and eliminate false positives Produce high-quality technical and executive-level reports with clear remediation guidance Support retesting / revalidation activities to confirm remediation effectiveness Collaborate with development and security teams to explain findings and mitigation strategies Follow responsible disclosure and ethical testing practices at all times

Qualifications

Bachelor’s degree in Computer Science, Information Security, or a related field (preferred) Relevant application security or penetration testing experience Demonstrated ability to perform manual testing beyond automated scans. Shall be able to complete Haumaru ASCP Lab Exam. ascp.haumaru.org (MUST)

Seniority level Entry level Employment type Full-time Job function Information Technology Industries Computer and Network Security