4+ years of experience in application security assessments, penetration testing, or offensive security engagements
Strong understanding of application security fundamentals, modern attack techniques, and common vulnerabilities affecting web applications, APIs, mobile applications, and cloud-native environments
Hands-on experience testing REST APIs, including authentication/authorization flaws, IDORs, injection vulnerabilities, session management issues, and business logic flaws
Strength with AWS services and cloud security concepts, including IAM, STS, S3, Lambda, API Gateway, CloudTrail, CloudWatch, and secure communication patterns such as SigV4
Solid understanding of networking and web fundamentals, including HTTP/HTTPS, TCP/IP, DNS, API communication flows, cookies, headers, and related concepts
Experience reviewing source code for security issues in Java, C#, and Python applications
Knowledge of secure coding principles and common risks such as SSRF, insecure deserialization, injection vulnerabilities, sensitive data exposure, and insecure cloud integrations
Understanding of SDLC, CI/CD pipelines, and secure development practices
Experience using security assessment and code review tools such as Burp Suite, Semgrep, Git, AWS CLI, and API testing/debugging tools
Comfortable working across Linux, Windows, and macOS environments
Experience or strong interest in AI/LLM security, including prompt injection, RAG risks, insecure integrations, excessive permissions, and the OWASP Top 10 for LLM Applications
Strong written and verbal communication skills, with the ability to deliver clear, actionable findings and communicate technical risks to both technical and executive stakeholders
Experience following structured testing methodologies, documentation standards, and validation/retesting workflows
Strong collaboration and interpersonal skills when working with security, engineering, and client teams
Ability to manage multiple concurrent engagements while maintaining high-quality deliverables and attention to detail
Curious, adaptable, and professional mindset with a passion for continuous learning and emerging security trends
Exposure to hardware or embedded device security testing
Familiarity with cloud-native and serverless architectures
Consulting or client-facing experience
Relevant security certifications or hands-on research contributions
Why Bishop Fox
At Bishop Fox, we're driven by a simple mission: deliver exceptional quality to our clients, foster a vibrant and fulfilling environment for our team, and champion excellence within our industry. Our core values, which we live by every day, are
Be Excellent to Each Other
Do the Right Thing
Do What You’ll Say You’ll Do
Get Better Together
Give a Sht
At Bishop Fox, we're committed to providing benefits that support your well-being and professional growth. Here's a glimpse of what we offer
Generous Time Off and Company-Wide Holidays
Team Events and International Travel Opportunities
Work From Home Support
Training Budget
Saving Fund
Food Coupons
Health and Wellbeing programs
This position is not eligible for visa sponsorship. Applicants must be authorized to work in Mexico for the duration of employment without sponsorship
Interested? Apply today!