DT
Senior Penetration Tester API, Web & Cloud – Contract (all genders)
Contract type
Ongoing
Work mode
Remote · Remote job
Experience
Senior · 5+ years
Job description
Senior Penetration Tester responsible for hands-on, authenticated security testing of partner-facing booking APIs, payment flows, web and mobile apps, and cloud infrastructure, working directly with engineering squads to remediate findings.
At a glance
- Employment
- Full-time
- Work mode
- Remote · Remote job
- Languages
- English
What you'll do
- Test partner-facing booking APIs against the OWASP API Security Top 10, focusing on object- and function-level authorization, tenant isolation, mass assignment, data exposure and rate limiting
- Assess API authentication and integrity end to end, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing
- Hunt for business-logic abuse in booking, checkout, payment and refund flows, including race conditions and pricing manipulation
- Run authenticated tests of traveller-, partner- and operator-facing web and mobile apps following OWASP WSTG and ASVS, including how passenger personal data is stored, shown and exported
- Review cloud, Kubernetes and CI/CD configurations and secrets handling for attack paths that could be chained from an application bug
- Map and regularly test the internet-facing attack surface
- Red-team AI features (assistants, agents, support bots) against the OWASP Top 10 for LLM Applications
- Write clear, reproducible, risk-rated findings with practical remediation guidance, walk engineers through fixes and verify them with retests
What we're looking for
- 5+ years of hands-on penetration testing, mainly of web applications and APIs, with recent engagements led end to end
- Deep, practical knowledge of the OWASP API Security Top 10, WSTG and ASVS, including authentication/authorization models (OAuth2/OIDC, JWT), IDOR/BOLA, mass assignment, SSRF, injection and XSS
- Experience finding business-logic and race-condition vulnerabilities in transactional systems such as booking, e-commerce, payments or fintech
- Fluent with Burp Suite Pro (or similar) and able to write own scripts and tooling (Python, Go or similar)
- Comfortable assessing cloud and container environments (GCP preferred, Kubernetes) and CI/CD pipelines
- Works independently: scopes, prioritises, tests and reports with minimal guidance, and explains complex risks plainly to engineers and leadership
- Available to start at short notice
Nice to have
- OSCP, OSWE, BSCP or similar certifications
- Experience red-teaming LLM applications or AI agents
- Testing in PCI-DSS environments
Benefits
- Fast-paced travel tech company with a flat organizational structure
- Exciting opportunities, ownership, and responsibility, contributing directly to the success of the company
- International team of talented and driven people with a clear mission
- Flexible work policy with the option of working remotely and international opportunities
- Competitive salary
Apply
About Distribusion
The world's leading ground transportation marketplace
Distribusion gives travellers seamless access to ground transportation online, from search to ticket purchase. It has built a B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.
Key facts
- Berlin, Germany
- Travel technology
- Connects bus, rail and ferry operators in 70+ countries with online retailers
- Backed by TQ Ventures, Lightrock, Creandum and Northzone
- Recently raised $80m Series C funding
- Remote-first company with HQ in Berlin
Partners & customers
Google MapsBooking.com