Senior Penetration Tester API, Web & Cloud – Contract (all genders)

Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.

We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany. Following our recent $80m Series C funding, we are ready to push beyond.

We are looking for an experienced Senior Penetration Tester to join us as soon as possible. You will run hands-on, authenticated security testing across a real attack surface: public partner-facing booking APIs, payment flows, web and mobile apps used by millions of travellers, and the cloud infrastructure behind them. You’ll plan and run your own testing, work directly with our engineering squads to get findings fixed, and see your impact in production within weeks.

What you will do:

• Test our partner-facing booking APIs against the OWASP API Security Top 10, with a focus on object- and function-level authorization, tenant isolation, mass assignment, data exposure and rate limiting.

• Assess API authentication and integrity end to end, including OAuth 2.0/OIDC, API keys, JWTs, webhooks and request signing.

• Hunt for business-logic abuse in booking, checkout, payment and refund flows, including race conditions and pricing manipulation.

• Run authenticated tests of traveller-, partner- and operator-facing web and mobile apps following OWASP WSTG and ASVS, including how passenger personal data is stored, shown and exported.

• Review cloud, Kubernetes and CI/CD configurations and secrets handling for attack paths that could be chained from an application bug.

• Map and regularly test our internet-facing attack surface.

• Red-team our AI features (assistants, agents, support bots) against the OWASP Top 10 for LLM Applications.

• Write clear, reproducible, risk-rated findings with practical remediation guidance, walk engineers through fixes and verify them with retests.
  

Workplace:

We are a remote-first company with teams located around the Globe and a HQ in Berlin.