Title: Senior Pentester (Web)
Company: DatsTeam
Location: Moscow
Experience: More than 6 years
Our distributed Dev team consists of over 800 specialists and has been developing its own products since 2012 – advertising platforms, gaming services and platforms, mobile gaming applications, fintech products and solutions.
We have a project-oriented approach, a matrix structure with specialists attached to one project, but we work as a team. We use SCRUM and Agile in our work.
We are looking for a professional for our security team.
Responsibilities:
- Conducting pentests of web applications and APIs (black-box, grey-box, white-box), including REST, GraphQL, gRPC, and WebSocket.
- Security testing of AI/LLM functionality (Prompt Injection, Data Leakage, RAG, MCP, Agentic AI, and other scenarios according to OWASP Top 10 for LLM).
- Testing of authentication and authorization mechanisms (OAuth 2.0, OIDC, SAML, JWT, SSO, MFA), as well as access control and error discovery (IDOR/BOLA, privilege escalation, multi-tenancy).
- Searching for and exploiting technical and business logic vulnerabilities, building complex attack chains (Attack Paths).
- Analyzing the security of the client-side and server-side of applications, dependencies, Software Supply Chain, and source code.
- Developing custom offensive tooling, PoCs, Burp Suite extensions, and automation tools using Python/JavaScript.
- Preparing technical reports with risk descriptions, remediation recommendations, and conducting retests after fixes.
- Participating in Threat Modeling, Security Architecture Review, and, if desired, in Purple Team activities.
Requirements:
- At least 4–5 years of experience in manual pentesting of web applications and APIs, with a strong command of black-box, grey-box, and white-box methodologies.
- Deep understanding of modern web vulnerabilities (OWASP Top 10) and practical experience exploiting XSS, SSRF, SSTI, SQL/NoSQL Injection, XXE, Deserialization, CSRF, CORS, Prototype Pollution, Path Traversal, and others.
- Experience testing REST, GraphQL, gRPC, WebSocket APIs, finding business logic vulnerabilities, and bypassing application protection mechanisms.
- Practical experience in analyzing authentication and authorization (OAuth 2.0, OIDC, SAML, JWT, SSO, MFA), including identifying implementation errors.
- Expert proficiency with Burp Suite Professional; experience developing custom extensions will be an advantage.
- Solid knowledge of Python and JavaScript/TypeScript for developing PoCs, exploits, and test automation.
- Experience conducting Security Research, analyzing modern frameworks and architectures (React, Angular, Vue, Spring, .NET, Node.js, Go, etc.).
- Experience testing AI/LLM applications, participating in Threat Modeling, Security Architecture Review, or Purple Team activities will be a plus.
Conditions:
- Several options for employment and payment methods;
- Full remote or hybrid office, work from any country with a convenient time zone;
- Flexible schedule – a lenient start to the day from 9:00 AM to 11:00 AM MSK, 8-hour workday;
- Option to choose familiar equipment with home delivery;
- Performance review and continuous learning: we have an internal Academy, as well as many partner programs that will share knowledge not only in professional areas but also support your hobbies;
- Developed communication culture: online and offline tournaments, tech communities, meetups, co-working days, meetings and parties on the summer terrace, team building events;
- An office with a panorama of the Moscow River and a summer terrace with hammocks and pizza for those working in Moscow, and local team building events in other cities and countries for remote employees.
Skills: Pentest, Information Security
