Senior Penetration Tester

Trading Technologies; Ahmedabad District; Ibrido; INR 4.000.000 - 6.500.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid work model

Paid time off

Volunteer day

Professional development days

Parental leave

Descrizione del lavoro

Trading Technologies Limited is seeking a Senior Penetration Tester to join the Offensive Security team in Ahmedabad. You will lead complex, full‑stack security assessments across web apps, APIs, cloud, and AD environments, partnering with engineering to remediate findings.

You will mentor junior testers, develop automation for testing, and deliver actionable remediation guidance. A strong background in OWASP, cloud security, and offensive tooling is required.

Competenze

• 7+ years of hands‑on experience in penetration testing, offensive security, or red teaming.
• Deep understanding of modern web application and API vulnerabilities (OWASP Top 10, CWEs), authentication protocols (OAuth, SAML).
• Proven experience with internal network pen testing and Active Directory exploitation (BloodHound, Impacket, Mimikatz).
• Strong cloud-native, containerization (Docker, Kubernetes), and DevOps pipeline security experience (GitLab, GitHub Actions, Jenkins).
• Expert-level tooling with Burp Suite Pro, Metasploit, Cobalt Strike, Nmap; strong Python, Bash, Go, or PowerShell skills.
• Excellent ability to translate technical findings into business risk for stakeholders.

Mansioni

• Lead end‑to‑end penetration tests across TT’s tech stack, including web apps, APIs, and internal networks.
• Assess cloud infrastructure (AWS/GCP) and CI/CD pipelines for misconfigurations and risks.
• Conduct AD abuse simulations, Kerberoasting, lateral movement, and privilege escalation testing.
• Produce high‑quality reports with PoCs, business impact and remediation guidance.
• Collaborate with engineering to validate fixes and support threat modeling or architecture reviews.
• Develop scripts or tooling to automate recurring testing tasks and workflows.
• Mentor junior testers and share security research with the team.

Conoscenze

Penetration testing

Web apps & APIs

Active Directory

Cloud & CI/CD security

Tooling & scripting

Communication skills

Strumenti

Burp Suite Pro

Metasploit

Cobalt Strike

Nmap

BloodHound

Impacket

Mimikatz

Docker

Kubernetes

GitLab

GitHub Actions

Jenkins

Descrizione del lavoro

Senior Penetration Tester

Department: Engineering

Employment Type: Permanent - Full Time

Location: Ahmedabad/GiftCity

Description

Trading Technologies is looking for a highly skilled and technically creative Senior Penetration Tester to join our internal Offensive Security (Offsec) team. Reporting directly to the Offensive Security Manager, you will be the technical tip of the spear in proactively identifying and exploiting vulnerabilities across our entire technology estate.

In this senior technical role, you will lead complex, full-stack security assessments ranging from modern web applications and complex APIs to cloud infrastructure, CI/CD pipelines, and deep-dive Active Directory environments. Beyond breaking things, you will partner closely with our engineering teams to ensure vulnerabilities are understood and effectively remediated, while also serving as a technical mentor to the broader security team.

Key Responsibilities

• Comprehensive Penetration Testing: Lead and execute advanced, end-to-end penetration tests across TT’s entire technology ecosystem, including complex web applications, microservices, REST/WebSocket APIs, internal network infrastructure, and thick-client trading applications.
• Cloud & DevOps Security: Conduct targeted assessments against our cloud infrastructure (e.g., AWS, GCP) and containerized environments. Actively test and identify misconfigurations or vulnerabilities within our CI/CD pipelines to secure our software supply chain.
• Infrastructure & Active Directory: Execute internal network penetration tests, including advanced Active Directory abuse and exploitation (e.g., Kerberoasting, lateral movement, privilege escalation) to identify internal structural weaknesses.
• Actionable Reporting: Produce comprehensive, high-quality technical reports that clearly articulate vulnerabilities, demonstrate business impact via proof-of-concepts (PoCs), and provide realistic, actionable remediation guidance for engineering teams.
• Remediation Support: Partner with the Offensive Security Manager and Engineering teams to validate fixes, provide technical clarity on vulnerabilities, and participate in threat modeling or architectural reviews as a subject matter expert.
• Tooling & Automation: Develop custom scripts, exploits, or automation tools to streamline internal penetration testing methodologies and improve the efficiency of the Offsec team.
• Technical Mentorship: Serve as a technical leader within the team, mentoring junior/mid-level testers, sharing cutting‑edge research, and elevating the team's overall technical proficiency.

Skills, Knowledge and Expertise

Essential Qualifications:

• Extensive Experience: 7+ years of hands‑on experience in penetration testing, offensive security, or red teaming.
• Application & API Expertise: Deep understanding of modern web application and API vulnerabilities (OWASP Top 10, CWEs), authentication protocols (OAuth, SAML), and testing methodologies.
• Infrastructure Mastery: Proven experience with network penetration testing, bypassing network segmentation, and conducting complex Active Directory exploitation (using tools like BloodHound, Impacket, Mimikatz, etc.).
• Cloud & CI/CD Proficiency: Strong understanding of cloud-native architectures, containerization (Docker, Kubernetes), and experience finding security flaws in DevOps pipelines (GitLab, GitHub Actions, Jenkins, etc.).
• Tooling & Scripting: Expert-level proficiency with industry-standard offensive tools (e.g., Burp Suite Pro, Metasploit, Cobalt Strike, Nmap). Strong programming/scripting abilities in Python, Bash, Go, or PowerShell to write custom tooling or modify exploits.
• Communication Skills: Exceptional ability to translate highly technical findings into clear, business‑focused risks for both technical and non‑technical stakeholders.

Desirable Qualifications:

• Industry Certifications: Highly regarded offensive security certifications such as OSCP, OSWE, OSEP, CRTO, GXPN, or equivalent.
• FinTech Experience: Previous experience testing high‑frequency trading platforms, financial technology, or heavily regulated environments.
• Community Involvement: A track record of independent vulnerability research, published CVEs, active bug bounty participation, or speaking engagements at security conferences (DEFCON, Black Hat, BSides).

Benefits

Competitive Benefits & Perks in India

We offer a comprehensive benefits package designed to support your well‑being, growth, and work‑life balance.

• Health & Financial Security:
  • Medical, Dental, and Vision coverage
• Time Off & Flexibility:
  • Enjoy the best of both worlds: the energy and collaboration of in‑person work, combined with the convenience and focus of remote days. This is a hybrid position requiring three days of in‑office collaboration per week, with the flexibility to work remote for the remaining two days. Our hybrid model is designed to balance individual flexibility with the benefits of in‑person collaboration, enhanced team cohesion, spontaneous innovation, hands‑on mentorship opportunities and strengthens our company culture.
  • 21 days of Paid Time Off (PTO) per year, with the option to roll over unused days.
  • One dedicated day per year for volunteering.
  • Two professional development days per year to allow uninterrupted professional development.
  • An additional PTO day is added during milestone anniversary years.
  • Robust paid holiday schedule with early dismissal.
  • Generous parental leave for all parents (including adoptive parents).
• Work‑Life Support & Resources:
  • Budget for tech accessories, including monitors, headphones, keyboards, and other office equipment.
  • Milestone anniversary bonuses.
• Wellness & Lifestyle Perks:
  • Subsidy contributions toward gym memberships and health/wellness initiatives.
• Our Culture:
  • Forward‑thinking, culture‑based organization with collaborative teams that promote diversity and inclusion.

Trading Technologies (www.tradingtechnologies.com) is a global capital markets platform services company providing market‑leading technology for the end‑to‑end trading operations of Tier 1 banks, brokerages, money managers, hedge funds, proprietary traders, Commodity Trading Advisors (CTAs), commercial hedgers, and risk managers. With its roots in listed derivatives, the Software-as-a-Service (SaaS) company delivers “multi‑X” solutions, with “X” representing asset classes, functions, workflows, and geographies. This multi‑X approach features trade execution services across futures and options, fixed income, foreign exchange (FX), and cryptocurrencies, augmented by solutions for data and analytics, including transaction cost analysis (TCA); quantitative trading; compliance and trade surveillance; clearing and post‑trade allocation; and infrastructure services. The award‑winning TT platform ecosystem also helps exchanges deliver innovative solutions to their market participants and technology companies to distribute their complementary offerings to Trading Technologies’ clients.

Trading Technologies is backed by leading global investment firms Thoma Bravo, one of the world’s largest and most experienced software investors, and 7Ridge, a global growth equity firm focused on technology‑enabled businesses.

This investment supports Trading Technologies’ continued focus on product innovation, platform scalability, and long‑term growth for customers and partners worldwide.

Trading Technologies (TT) is an equal‑opportunity employer. Equal employment has been, and continues to be, a required practice at the Company. Trading Technologies’ practice of equal employment opportunity is to recruit, hire, train, promote, and base all employment decisions on ability rather than race, color, religion, national origin, sex/gender orientation, age, disability, sexual orientation, genetic information, parental status, veteran, or any other protected status. Additionally, TT participates in the E‑Verify Program for US offices.