About this role
Trading Technologies is looking for a highly skilled and technically creative Senior Penetration Tester to join our internal Offensive Security (Offsec) team. Reporting directly to the Offensive Security Manager, you will be the technical tip of the spear in proactively identifying and exploiting vulnerabilities across our entire technology estate. In this senior technical role, you will lead complex, full-stack security assessments ranging from modern web applications and complex APIs to cloud infrastructure, CI/CD pipelines, and deep-dive Active Directory environments. Beyond breaking things, you will partner closely with our engineering teams to ensure vulnerabilities are understood and effectively remediated, while also serving as a technical mentor to the broader security team.
- Comprehensive Penetration Testing: Lead and execute advanced, end-to-end penetration tests across TT’s entire technology ecosystem, including complex web applications, microservices, REST/WebSocket APIs, internal network infrastructure, and thick-client trading applications.
- Cloud & DevOps Security: Conduct targeted assessments against our cloud infrastructure (e.g., AWS, GCP) and containerized environments.
- Actively test and identify misconfigurations or vulnerabilities within our CI/CD pipelines to secure our software supply chain.
- Infrastructure & Active Directory: Execute internal network penetration tests, including advanced Active Directory abuse and exploitation (e.g., Kerberoasting, lateral movement, privilege escalation) to identify internal structural weaknesses.
- Actionable Reporting: Produce comprehensive, high-quality technical reports that clearly articulate vulnerabilities, demonstrate business impact via proof-of-concepts (PoCs), and provide realistic, actionable remediation guidance for engineering teams.
- Remediation Support: Partner with the Offensive Security Manager and Engineering teams to validate fixes, provide technical clarity on vulnerabilities, and participate in threat modeling or architectural reviews as a subject matter expert.
- Tooling & Automation: Develop custom scripts, exploits, or automation tools to streamline internal penetration testing methodologies and improve the efficiency of the Offsec team.
- Technical Mentorship: Serve as a technical leader within the team, mentoring junior/mid-level testers, sharing cutting-edge research, and elevating the team's overall technical proficiency.