Junior/Middle Penetration Tester

Job Description

• Conduct penetration testing of the Bank’s internal and external information systems, network infrastructure, web and mobile applications, and APIs to identify vulnerabilities, weaknesses, and potential information security risks.
• Perform Vulnerability Assessments, including manual verification, validation, and exploitability assessment of identified vulnerabilities.
• Conduct security testing of Windows, Active Directory, and Linux infrastructures, including Privilege Escalation, Credential Access, and Lateral Movement scenarios.
• Perform security testing of web applications and APIs, including Authentication/Authorization Flaws, IDOR, Injection, SSRF, XSS, File Handling, Business Logic, and other vulnerabilities.
• Assess potential attack progression and the possible impact on the Bank’s information systems and infrastructure by exploiting identified vulnerabilities.
• Prepare technical reports describing identified vulnerabilities, supporting evidence, risk and impact assessments, and practical remediation recommendations.
• Retest remediated vulnerabilities to verify the effectiveness of the implemented measures and confirm that the vulnerabilities have been effectively resolved.
• Collaborate with relevant stakeholders in analyzing and remediating identified vulnerabilities.
• Keep up to date with emerging information security threats, vulnerabilities, and attack techniques, and apply acquired knowledge to Penetration Testing activities.
• Participate in improving Penetration Testing methodologies, tools, and processes.
• Participate in selected Red Team / Adversary Emulation scenarios to simulate attack chains and assess the effectiveness of Detection/Response capabilities.

Required Education and Skills

• Practical experience in Penetration Testing / Security Testing / Offensive Security, or demonstrable evidence of relevant practical skills. CTFs, Home Labs, training or personal projects, portfolios, and professional certifications may also be considered. For Middle-level candidates, at least two years of relevant work experience is preferred.
• A university degree in Information Security, Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent professional experience. Candidates who are currently students may also be considered.
• Practical understanding of Penetration Testing and Vulnerability Assessment processes, including vulnerability discovery, manual testing, validation, and exploitability assessment. Practical experience gained through training, lab environments, or personal projects is also acceptable.
• Good knowledge of TCP/IP, DNS, HTTP/HTTPS, TLS, VPN, and fundamental network protocols, as well as network segmentation and the operating principles of corporate network infrastructures.
• Knowledge of Windows and Linux operating systems, as well as Active Directory architecture and its fundamental security mechanisms.
• Knowledge of web application and API architecture, common attack vectors and vulnerabilities, including OWASP Top 10.
• Practical skills in using core Penetration Testing tools, including Burp Suite, Nmap, and Kali Linux, as well as familiarity with Metasploit, BloodHound, Impacket, NetExec/CrackMapExec, or equivalent tools.
• General understanding of common attack techniques and stages, including Privilege Escalation, Credential Access, Lateral Movement, Persistence, and other relevant techniques.
• General knowledge of key Penetration Testing and Offensive Security methodologies and frameworks, including OWASP Web Security Testing Guide (WSTG), PTES, MITRE ATT&CK, and NIST SP 800-115.
• Basic knowledge of at least one of the following languages: Python, PowerShell, or Bash, and the ability to understand, modify, or create simple scripts.
• Ability to clearly document and communicate identified vulnerabilities, their exploitability, impact, and associated risks.
• Analytical thinking, a creative and unconventional approach to problem-solving, the ability to learn independently, and a commitment to continuously developing professional skills.
• Ability to work independently and as part of a team, as well as communicate effectively with various technical teams.
• High standards of professional ethics, a strong sense of responsibility, and strict adherence to confidentiality requirements.
• Sufficient English proficiency to read technical documentation, security research, Vulnerability Advisories, and other professional materials.

Will Be Considered an Advantage

Experience in Red Team / Adversary Emulation exercises or attack chain simulation.

Experience in advanced Active Directory security testing and Attack Path analysis.

Experience in additional areas such as Mobile Application Security Testing, Container/Cloud Security, or related fields.

Experience testing the security of information systems and infrastructure in banking or financial institutions.

Professional certifications such as eJPT, PJPT, PNPT, CPTS, OSCP/OSCP+, CRTP/CRTO, eWPT/eWPTX, or equivalent certifications.

Participation in Bug Bounty programs, as well as practical training and skills development on specialized information security platforms such as Hack The Box, TryHackMe, PortSwigger Web Security Academy, Cisco Networking Academy, OffSec Proving Grounds, PentesterLab, or equivalent platforms.

What We Expect from the Candidate

A practical interest in Offensive Security and Penetration Testing, the ability to identify and validate real-world vulnerabilities and assess their risks, and a commitment to continuously developing technical knowledge and practical skills.

The primary focus of the role is Penetration Testing, while Red Team / Adversary Emulation is considered an additional area that will be developed gradually.

Application period

Start date: September 2, 2026

Closing date: October 15, 2026