Penetration Tester

Position Summary

As a key member of our Internal Product Security Engineering team, you will lead penetration-testing engagements for high-scale web applications and APIs, validating security controls and uncovering exploitable weaknesses. In parallel, you will conduct structured threat-modeling workshops and security-design reviews for new features and services, managing each engagement from scoping to remediation follow-up in close partnership with engineering and cross-functional stakeholders. The insights you provide will drive prompt fixes and shape the organization's long-term security roadmap.

Key Responsibilities

• Penetration Testing
• Plan, execute, and document manual and tool-assisted tests for enterprise-scale web apps and REST / GraphQL / gRPC APIs.
• Demonstrate exploitation paths (auth / logic / data exposure) and develop proofs-of-concept.
• Retest remediations and deliver clear, prioritized reports.
• Threat Modeling & Security Design Review
• Facilitate formal and informal Threat Modeling using STRIDE-like frameworks or Attack-Tree sessions for new or significantly modified services.
• Produce risk artefacts, recommend mitigations, and track closure of findings.
• Security Engineering & Advocacy
• Champion secure-by-default patterns (least privilege, IaC hardening, SDL best practices) across the SDLC.
• Contribute to internal security tooling and CI / CD guardrails.

Requirements :

Preferred Qualifications

Personal Attributes