Sr. Engineer – Pen Tester

Overview

Lead technical security assessments, including application-layer and network-layer penetration testing, to identify, validate and help resolve security vulnerabilities across cloud infrastructure and applications.

What you'll do

• Perform comprehensive manual and automated application-layer penetration tests to identify vulnerabilities, adhering to industry standards and internal methodologies.
• Conduct network-layer penetration tests encompassing all components supporting network functions and operating systems.
• Validate segmentation and scope-reduction controls at least annually and after any significant changes to ensure isolation of the Cardholder Data Environment (CDE).
• Triage and validate vulnerabilities reported through bug bounty program.
• Document and risk-rate all findings, providing actionable remediation guidance to engineering and product teams.
• Verify the correction of exploitable vulnerabilities through re-testing and post-remediation assessments.
• Collaborate with external 3rd party security firms on penetration testing and threat hunting exercises.
• Ensure all security assessments and remediation activities meet compliance and regulatory obligations (e.g., PCI DSS, SOC).

What you'll need

• Minimum of 4+ years of hands-on experience in penetration testing, ethical hacking, or application security engineering.
• Deep understanding of common web-based attacks (SQLi, XSS, CSRF, XXE, etc.) and how to mitigate them at the application level.
• Proficiency in scripting or programming languages such as Python, Go, Ruby, or Bash to automate security tasks.
• Comprehensive knowledge of network protocols and security concepts, including TCP/IP, DNS, HTTP/S, TLS, and IPSEC.
• Strong experience with security testing tools (e.g., BurpSuite Enterprise, SAST, DAST, and IAST).
• Working knowledge of OWASP security fundamentals and API identity/access management (OAuth 2.0, OIDC, JWT).
• Ability to work with high autonomy and communicate technical security findings clearly to both technical and non-technical audiences.
• Relevant information security certification(s) such as OSCP, CEH, OSWE, or CISSP.

Nice to have

• Direct experience managing or triaging a public bug bounty program (e.g., HackerOne, BugCrowd).
• Experience leveraging Slack/ChatOps to automate security tasks or reporting.
• Experience with cloud orchestration and Infrastructure as Code (e.g., Terraform, Google Deployment Manager).
• Familiarity with containerization and orchestration tooling like Docker and Kubernetes.
• Knowledge of compliance frameworks such as ISO 27001, PCI DSS, SOC2, or CCPA.