Senior Security Engineer – Penetration Testing

About the role

We are looking for an experienced Senior Security Engineer to lead penetration testing efforts and strengthen our overall security posture. You will work closely with engineering, product and business teams to embed security throughout our systems and development pipelines.

Key responsibilities

• Plan and execute authorized penetration tests for web, mobile, API and backend services.
• Perform threat modelling, attack‑surface analysis and risk‑based scoping.
• Identify, validate and safely demonstrate vulnerabilities using automated and manual techniques.
• Produce technical reports with risk ratings, reproducible steps and remediation recommendations.
• Collaborate with development and DevOps teams to validate fixes and promote secure coding practices.
• Integrate security testing (SAST/DAST) into CI/CD pipelines.
• Conduct security architecture reviews and assess risks for new and existing systems.
• Support audits, compliance activities and incident response as needed.
• Mentor engineers and contribute to a collaborative security culture.

Required profile

• 8+ years of experience in cybersecurity, security engineering or related fields.
• Proven experience designing and securing cloud, hybrid or enterprise environments.
• Strong knowledge of identity and access management, network security, application security, data protection, incident response and vulnerability management.
• Experience with AWS, Microsoft Azure or Google Cloud Platform.
• Familiarity with security frameworks such as ISO 27001, NIST CSF, CIS Controls or SOC 2.
• Understanding of secure coding practices, OWASP Top 10 and API security risks.

Required skills

• Penetration‑testing tools: Burp Suite, ZAP, Nmap, Metasploit, sqlmap, API fuzzers.
• Scripting/automation: Python, Bash.
• Cloud platforms: AWS, Microsoft Azure, Google Cloud Platform.
• Security frameworks: ISO 27001, NIST CSF, CIS Controls, SOC 2.
• Secure coding standards: OWASP Top 10.
• CI/CD security: SAST, DAST, DevSecOps.
• Infrastructure as code, containers, Kubernetes, microservices.