Penetration Tester

About the Position

Penetration Tester

You will conduct offensive security testing across web applications, APIs, and network infrastructure, and run adversary simulation exercises. A defining part of this role is direct collaboration with the Security Operations Center (SOC) - your exercises validate whether the SOC detects realistic attacks and your findings drive SIEM rule improvements and playbook updates. You bridge offensive operations and defensive capability building.

Responsibilities

• Plan and execute web application penetration tests across black box, grey box, and white box engagements
• Conduct API security testing including authentication, authorization, injection, and business logic flaws
• Execute network and infrastructure penetration tests
• Plan and run Red Team exercises including full adversary simulation campaigns and attack scenario design
• Execute social engineering simulations at the technical level including phishing campaigns
• Identify and report business logic flaws with a focus on financial impact - fraud scenarios, unauthorized transactions, privilege abuse, and data exposure
• Conduct SOC detection gap analysis - attack in a controlled manner and assess whether the SOC detects and responds correctly
• Validate SIEM rule effectiveness through controlled adversarial Tactics, Techniques, and Procedures (TTPs) in coordination with Security Engineers
• Debrief SOC L1/L2 analysts after exercises explaining attacker Tactics, Techniques, and Procedures (TTPs), tools used, and indicators that should have triggered detection
• Hand off detection gap findings to the SOC Team for use case development
• Produce clear structured pentest reports with severity ratings, proof of concept, and remediation guidance
• Coordinate and execute retesting after remediation to verify fixes
• Stay current on CVEs, exploit techniques, and threat actor Tactics, Techniques, and Procedures (TTPs) relevant to fintech

Requirements

• 3+ years of hands-on penetration testing experience across web applications and infrastructure
• Proficiency in web application testing - OWASP Top 10, authentication flaws, injection, IDOR, business logic vulnerabilities
• Experience with API security testing (REST, GraphQL, OAuth flows)
• Solid understanding of network protocols and common infrastructure attack vectors
• Proficiency with standard offensive tooling: Burp Suite Pro, Metasploit, Nmap, Nuclei, SQLmap, Gobuster
• Ability to map findings to MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs)
• Experience producing professional pentest reports readable by both technical and non-technical audiences
• Understanding of how defensive tooling works - SIEM detection logic, AV/EDR behavioral rules, WAF signatures - to conduct realistic and evasion-aware testing
• English - professional proficiency for report writing and client communication

Nice to Have

• Experience running formal Red Team engagements beyond standard pentests
• Mobile application security testing (iOS and Android) using Frida, Objection, or MobSF
• Active Directory attack techniques - Kerberoasting, DCSync, Pass-the-Hash, ADCS abuse
• Cloud environment testing (AWS, Azure, or GCP)
• Custom script or tool development for specific attack scenarios (Python or Go)
• Familiarity with TIBER-EU or CBEST frameworks relevant to fintech regulatory context
• Experience in purple team exercises working alongside a defensive team
• OSCP, OSEP, BSCP, CRTE, or equivalent certification

Employment Details

• Type: Full-time
• Experience Level: Middle
• Experience Years: 3-5