Advanced Product Security Senior Tester

Overview

Identify potential vulnerabilities within the bank's IT systems using penetration testing tools and techniques to ensure the security of computer systems, applications, servers, and networks.

What you'll do

• Develop and execute assessments, audits, and threat models to identify vulnerabilities within the bank's systems, applications and servers using penetration tools and techniques, and communicate key findings and recommendations to stakeholders.
• Collaborate with stakeholders and IT teams to identify emerging cyber-attack techniques, tools and technologies and support the development of penetration testing methodologies.
• Develop and maintain comprehensive documents and reports for senior stakeholders on penetration test findings and remediation guidance.
• Collaborate with stakeholders to understand their security requirements and controls in business processes, applications and services, to enhance overall security posture and assurance.
• Identify emerging vulnerabilities, exploit codes and cyber-attacks to develop testing methodologies and assurance activities.
• Contribute to or set strategy, drive requirements and make recommendations for change.
• Plan resources, budgets, and policies; manage and maintain policies and processes; deliver continuous improvements and escalate breaches of policies or procedures.
• Advise key stakeholders, including functional leadership teams and senior management, on functional and cross-functional areas of impact and alignment.
• Manage and mitigate risks through assessment, in support of the control and governance agenda.
• Create solutions based on sophisticated analytical thought, comparing and selecting complex alternatives.
• Seek out, build and maintain trusting relationships and partnerships with internal and external stakeholders, using influencing and negotiating skills to achieve outcomes.

What you'll need

• Strong software development and secure code review skills, with the ability to analyse codebases, trace data and control flows, and identify complex design, implementation and business-logic vulnerabilities.
• Architecture review and threat modelling, including identifying trust boundaries, abuse cases and attack paths, and translating them into targeted security test cases.
• Advanced penetration testing of web applications, APIs and modern platforms, combining white-box and dynamic techniques to validate exploitability and create controlled proof-of-concept exploits.
• Correlating source-code analysis with runtime testing to identify root causes, control bypasses and vulnerabilities that automated tools or conventional testing may miss.
• Assessing cloud-native, containerised, distributed or AI-enabled applications and their supporting security controls.
• Producing clear, reproducible technical findings, risk assessments and practical remediation guidance for engineering and senior stakeholders.
• AI-assisted AppSec and penetration-testing techniques with appropriate human validation, evidence checking and protection of sensitive information.
• Leading complex technical assessments, performing peer review and collaborating across Product, Engineering, Architecture, AppSec and Penetration Testing teams.

Nice to have

• Advanced degree in Computer Science/Engineering, Cybersecurity, or related field.
• Experience in financial services or other regulated environments.
• Professional experience combining software engineering with product security, secure code review or penetration testing.
• Vulnerability research, reverse engineering, exploit development, custom security tooling or test automation.
• Knowledge of OWASP ASVS, SAMM and testing guidance, together with relevant NIST and MITRE frameworks.
• Relevant certifications such as CREST, OSCP, OSEP, OSWE, GIAC/SANS or CSSLP, or equivalent demonstrable practical expertise.

Details

• Based out of Pune.