Application Security Engineer

HighCraft is looking for an Application Security Engineer to assess a healthcare platform for practitioners and patients.
This is an ongoing remote, part-time contract, starting with a security assessment estimated at 4060 hours. You will then provide security reviews and support as new features and integrations are developed.
What you will do
Perform manual security assessments of web applications and APIs.
Identify and validate vulnerabilities in authentication, access controls, business logic and data handling.
Review security-sensitive changes and third-party integrations.
Document findings with clear evidence, reproduction steps and practical remediation guidance.
Work with developers to resolve security issues and retest fixes.
What we are looking for
Hands-on experience independently testing authenticated web applications and APIs.
Practical understanding of OWASP web and API security, authentication, authorization and multi-tenant applications.
Ability to investigate and validate findings manually using HTTP requests and application behavior.
Clear technical reporting and practical remediation guidance.
Upper-Intermediate English (B2), with the ability to discuss findings with developers.
Experience with Burp Suite, .NET, Azure or healthcare systems is a plus.
To apply
Please include:
Your relevant web/API security testing experience.
Your expected hourly rate.
Your weekly availability and earliest start date.
A brief, anonymized example of a security issue you identified and how you documented it.