VP Penetration Testing / Lead Pen Testing

MANCER Consulting Services Pvt. Ltd.; Chennai, Mumbai; Hybrid; INR 2,600,000 - 6,000,000; Full time

Job summary

The Ethical Pen Testing Leader will join a dynamic team of world class security experts to conduct application security/penetration tests of our internal/external web, mobile, web, and web API service applications, leveraging both manual techniques as well as automated tools to uncover and report security vulnerabilities that exist.

You must be knowledgeable with business risks associated to common security vulnerabilities and to be able to effectively communicate complex technical concepts such

Qualifications

• Experience leading pen testing engagements in enterprise security environments.
• Ability to communicate complex security risks to developers and senior management.
• Hands-on testing with web/mobile technologies and common vulnerabilities.
• Proven ability to build and scale Pen Testing capabilities in large teams.

Responsibilities

• Lead and manage application security/penetration testing efforts across web, mobile, and API services.
• Perform vulnerability assessments, code reviews and manual/automated testing.
• Report findings with clear risk guidance to stakeholders and developers.
• Mentor and coordinate large security testing teams in enterprise settings.

Skills

Penetration testing leadership

Web/mobile app security

Communication to developers/management

Team management

OWASP Top 10

Threat modeling

Manual testing

Executive presence

Scripting: Python

Certifications: GWAPT/CEH/OSCP/SANS

Tools

Invicti DAST Scanner

Burp Suite Pro

Checkmarx

SoapUI

Job description

Job Description

The Ethical Pen Testing Leader will join a dynamic team of world class security experts to conduct application security/penetration tests of our internal/external web, mobile, web, and web API service applications, leveraging both manual techniques as well as automated tools to uncover and report security vulnerabilities that exist.
You must be knowledgeable with business risks associated to common security vulnerabilities and to be able to effectively communicate complex technical concepts such as security vulnerabilities to application developers and/or senior managers who may have little to no experience with application security.
The must have the ability to work independently in a very large scale, enterprise setting and collaborate with peer team members. Previous experience as an application security professional with a large Financial Institution a plus.

Foundational Skills:

• Web application vulnerability scanning tools (Invicti DAST Scanner, SoapUI, Burp Suite Pro, Checkmarx)
• Conducting vulnerability assessments, code reviews and penetration tests against web/mobile application technologies, services, platforms and languages to find flaws and exploits
• Strong Development background with hands on experience on Pen Testing
• Experience in setting up Pen Testing capability in India
• Experience in managing large teams
• Executive presence. Very Good Communication & Interpersonal skills
• Experience conducting vulnerability assessments, code reviews and penetration tests against web/mobile application technologies, services, platforms and languages to find flaws and exploits (e.g., SQL Injection, Cross-Site Scripting, Cross-Site Request Forgery, Clickjacking, Authentication/Authorization, Privilege Escalation, Business Logic Bypass, OWASP Top 10, SANS Top 25 etc.).
• Knowledge of network and Web related protocols/technologies.
• Ability to demonstrate manual web application testing experience.
• Experience with web application vulnerability scanning tools (e.g. Invicti DAST Scanner, SoapUI, Burp Suite Pro, Checkmarx etc.).
• Experience with vulnerability assessment tools and penetration testing techniques (e.g. web application proxies, packet capture analysis software, browser extensions, advanced penetration testing tools (full stack), Linux distributions, Windows OS, etc.).
• Experience of penetration testing on mobile platforms such as iOS and Android, mobile device simulators.
• Solid programming/debugging skills with proficiency in one or more of the following: Java, JavaScript, HTML, XML, PHP, ASP.NET, AJAX, JSON, Objective-C, and SOAP/REST web APIs.
• Expert-level experience and very details technical knowledge in at least 3 of the following areas:
  • General information security.
  • Security engineering.
  • Application architecture.
  • Authentication and security protocols.
  • Application session management.
  • Applied cryptography.
  • Common communication protocols.
  • Mobile frameworks.
  • Single sign-on technologies.
  • Development frameworks (Angular, React, etc.).
  • Exploit automation platforms.
  • Threat modeling.
• Demonstrated ability to learn and apply critical thinking to a variety of situations.
• One or more of the following certifications: GWAPT, CEH, OSCP, SANS (or qualified work experience).
• Strong scripting skills (e.g. Python, Perl, Shell script, JavaScript).
• Mobile programming abilities such as Xcode, Objective-C.