Senior Security Penetration Tester

NatWest Group; Gogar; On-site; GBP 50,000 - 70,000; Full time

Job summary

A leading financial institution in Scotland is seeking a Senior Security Penetration Tester to conduct penetration tests and ensure robust security throughout the project lifecycle. The ideal candidate will possess relevant security certifications and tools experience. This role offers opportunities to engage with various teams and protect both colleagues and customers through secure services.

Qualifications

• Experience in penetration testing and knowledge of security technology controls.
• Ability to manage testing assignments and produce high-quality reports.
• Understanding of OWASP Top Ten vulnerabilities.

Responsibilities

• Conduct penetration testing to find vulnerabilities impacting business.
• Engage with projects to ensure secure production.
• Deliver meaningful testing and maintain up-to-date skills.

Skills

Penetration testing

Agile methodologies

Communication skills

Analytical skills

Education

Relevant security certification (e.g., OSCP, CREST)

Tools

Burp Suite

Metasploit

Nmap

Nessus

Job description

Join us as a Senior Security Penetration Tester

• Take on a new challenge and use your specialist knowledge to support the wider bank in building and operating secure services that protect both colleagues and customers
• You’ll act as a subject matter expert in a security related field, making sure that the security implications of the backlog are understood in the right way, building security early into design
• You’ll be joining an exciting and fast-paced area of the bank, where you can expect great exposure both for you and your work

What you'll do

As a Senior Security Penetration Tester, you’ll work at a domain level to understand and ensure robust security is continuously considered and incorporated at every stage, programme increment and feature team delivery.

You will be responsible for conducting penetration testing, looking for vulnerabilities with real business impact. NatWest Group have a wide range of systems and services ensuring a variety of test scenarios.

You’ll also:

• Conduct security testing such as Web Application and API testing independently and as part of a team for larger projects

• Scope and refinine requirements to deliver value for money and meaningful testing
• Engage with customers to offer a high level of service to bank’s internal project teams to assist getting projects into production securely
• Maintain a high level of skills and keep up to date with vulnerabilities in modern web application systems, Network, Mobile, Thick Client, and Cloud testing
• Support with the identification of risks, while contributing to risk management strategies to achieve business objectives and customer outcomes
• Use specialist knowledge to support the wider organisation in building and operating secure services that protect both colleagues and customers
• Make complex or technical issues actionable by colleagues through effective communication
• Building and leveraging relationships with colleagues across the group and where appropriate, with third parties, to make sure decisions made are commercially focused and create long term value for the organisation

The skills you'll need

You’ll need penetration testing experience and knowledge of technology security controls within the security technology specialism along with an understanding of Agile methodologies.

You’ll also require experience of managing penetration testing assignments, including scoping, delivering tests and producing high quality reports in line with good industry practice, as well as familiarity with testing tools like Burp Suite and common bApp store extensions, plus Metasploit, nmap, and Nessus.

You’ll also demonstrate:

• Experience with one of the certification, such as, OSCP/OSWA, CRT/CSTM, CWES/CPTS, BurpSuite Certified Practitioner CREST, Cyberscheme, Tigerscheme or Offensive security
• An understanding of the OWASP Top Ten vulnerabilities, how to identify and exploit them
• Excellent verbal and written communication skills and able to adapt for technical and non-technical audiences
• Strong communication skills, ability to write technical reports, detailed presentation and documentation
• Experience of providing accurate reports with well-evidenced issues demonstrating the full impact of any identified vulnerabilities
• Strong analytical and problem solving skills