Senior Penetration Tester

Department: Engineering

Employment Type: Permanent - Full Time

Location: Ahmedabad/GiftCity

Description

Key Responsibilities

• Comprehensive Penetration Testing: Lead and execute advanced, end-to-end penetration tests across TT’s entire technology ecosystem, including complex web applications, microservices, REST/WebSocket APIs, internal network infrastructure, and thick-client trading applications.
• Cloud & DevOps Security: Conduct targeted assessments against our cloud infrastructure (e.g., AWS, GCP) and containerized environments. Actively test and identify misconfigurations or vulnerabilities within our CI/CD pipelines to secure our software supply chain.
• Infrastructure & Active Directory: Execute internal network penetration tests, including advanced Active Directory abuse and exploitation (e.g., Kerberoasting, lateral movement, privilege escalation) to identify internal structural weaknesses.
• Actionable Reporting: Produce comprehensive, high-quality technical reports that clearly articulate vulnerabilities, demonstrate business impact via proof-of-concepts (PoCs), and provide realistic, actionable remediation guidance for engineering teams.
• Remediation Support: Partner with the Offensive Security Manager and Engineering teams to validate fixes, provide technical clarity on vulnerabilities, and participate in threat modeling or architectural reviews as a subject matter expert.
• Tooling & Automation: Develop custom scripts, exploits, or automation tools to streamline internal penetration testing methodologies and improve the efficiency of the Offsec team.
• Technical Mentorship: Serve as a technical leader within the team, mentoring junior/mid-level testers, sharing cutting-edge research, and elevating the team's overall technical proficiency.

Skills, Knowledge and Expertise

• Extensive Experience: 7+ years of hands-on experience in penetration testing, offensive security, or red teaming.
• Application & API Expertise: Deep understanding of modern web application and API vulnerabilities (OWASP Top 10, CWEs), authentication protocols (OAuth, SAML), and testing methodologies.
• Infrastructure Mastery: Proven experience with network penetration testing, bypassing network segmentation, and conducting complex Active Directory exploitation (using tools like BloodHound, Impacket, Mimikatz, etc.).
• Cloud & CI/CD Proficiency: Strong understanding of cloud-native architectures, containerization (Docker, Kubernetes), and experience finding security flaws in DevOps pipelines (GitLab, GitHub Actions, Jenkins, etc.).
• Tooling & Scripting: Expert-level proficiency with industry-standard offensive tools (e.g., Burp Suite Pro, Metasploit, Cobalt Strike, Nmap). Strong programming/scripting abilities in Python, Bash, Go, or PowerShell to write custom tooling or modify exploits.
• Communication Skills: Exceptional ability to translate highly technical findings into clear, business-focused risks for both technical and non-technical stakeholders.

• Industry Certifications: Highly regarded offensive security certifications such as OSCP, OSWE, OSEP, CRTO, GXPN, or equivalent.
• FinTech Experience: Previous experience testing high-frequency trading platforms, financial technology, or heavily regulated environments.
• Community Involvement: A track record of independent vulnerability research, published CVEs, active bug bounty participation, or speaking engagements at security conferences (DEFCON, Black Hat, BSides).

Benefits

• Health & Financial Security:
  • Medical, Dental, and Vision coverage
• Time Off & Flexibility:
  • Enjoy the best of both worlds: the energy and collaboration of in-person work, combined with the convenience and focus of remote days. This is a hybrid position requiring three days of in-office collaboration per week, with the flexibility to work remotely for the remaining two days. Our hybrid model is designed to balance individual flexibility with the benefits of in-person collaboration, enhanced team cohesion, spontaneous innovation, hands-on mentorship opportunities and strengthens our company culture.
  • 21 days of Paid Time Off (PTO) per year, with the option to roll over unused days.
  • One dedicated day per year for volunteering.
  • Two professional development days per year to allow uninterrupted professional development.
  • An additional PTO day is added during milestone anniversary years.
  • Robust paid holiday schedule with early dismissal.
  • Generous parental leave for all parents (including adoptive parents).
• Work-Life Support & Resources:
  • Budget for tech accessories, including monitors, headphones, keyboards, and other office equipment.
  • Milestone anniversary bonuses.
• Wellness & Lifestyle Perks:
  • Subsidy contributions toward gym memberships and health/wellness initiatives.
• Our Culture:
  • Forward-thinking, culture-based organization with collaborative teams that promote diversity and inclusion.