Job Description

We are seeking a skilled and passionate Penetration Tester with hands-on experience in identifying vulnerabilities across mobile applications (iOS/Android), web applications, infrastructure, and thick client environments. The ideal candidate will have a strong background in assessing the security posture of applications, systems, and networks, especially in a fast-paced fintech environment.

Key Responsibilities

Conduct penetration tests on web and mobile applications, networks, thick clients, and systems to identify vulnerabilities.

Perform manual and automated testing to simulate cyberattacks and exploit potential security flaws.

Create detailed reports of vulnerabilities including descriptions, proof of concepts, business impact, and actionable remediation steps.

Perform retesting to validate fixes and confirm mitigations.

Analyze security issues related to web apps, network protocols, OSs, and cloud platforms.

Stay updated with the latest cybersecurity threats, vulnerabilities, and attack techniques.

Coordinate with application and infrastructure teams during the assessment lifecycle and deliver clear, comprehensive reports.

Requirements

Proven experience as a Penetration Tester or in a cybersecurity role.

Strong understanding of:

OWASP Mobile Top 10

OWASP Web Top 10

MITRE ATT&CK framework

Proficiency in tools such as:

Burp Suite, Frida, MobSF, Nmap, Wireshark, Metasploit

Hands-on experience with:

SSL pinning bypass

Jailbreak/root detection bypass

Certificate validation flaws

Mobile app reverse engineering

Familiarity with operating systems like Windows, Kali Linux, and macOS

Exposure to cloud platforms such as AWS, Azure, or GCP

Knowledge of scripting/programming languages such as Python, Bash, or PowerShell (preferred)

Relevant certifications are a strong advantage:

CEH, OSCP, or similar

Preferred Skills

Prior experience in mobile application penetration testing

Ability to work independently and manage time effectively

Excellent communication skills, especially in conveying technical findings to non-technical stakeholders