Oferta pracy

Pracodawca zakończył zbieranie zgłoszeń na tę ofertę

Aktualne oferty pracodawcy

Pracodawca zakończył zbieranie zgłoszeń na tę ofertę

Aktualne oferty pracodawcy
Oferta z szybkim aplikowaniem 
co to?
Na oferty z aktywnym „Aplikuj szybko” zaaplikujesz jednym kliknięciem. Korzystają one z danych używanych przez Ciebie przy ostatnim aplikowaniu. Jeśli jeszcze tego nie robiłaś/eś, nie przejmuj się. Za pierwszym razem trafisz na pełny formularz aplikowania.

(Cybersecurity) Senior Penetration Tester

HSBC Service Delivery (Polska) Sp. z o.o.

  • Kapelanka 42a, Dębniki, Kraków
    Kraków, Lesser Poland
  • offer expired over a month ago
  • contract of employment
  • full-time
  • senior specialist (Senior)
  • hybrid work
  • remote recruitment
  • запрошуємо працівників з України
ukrainian-friendly-overlay
Запрошуємо працівників з України
Роботодавець відкритий для працевлаштування громадян України

HSBC Service Delivery (Polska) Sp. z o.o.

Kapelanka 42a

Dębniki

Kraków

Technologies we use

Expected

  • HTML

  • XML

  • JavaScript

  • JSON

  • REST

About the project

This job role is responsible for providing subject matter expertise in Penetration Testing to support wider Cyber Security efforts and organization. The successful candidate will operate as part of a global/regional team within the Cybersecurity organization to provide expertise, oversight and assurance around security process, controls, standards and regulatory requirements.

Your responsibilities

  • Perform highly technical/analytical security assessments of custom mobile applications, widely understood infrastructure and networks, web services and APIs. This covers manual penetration testing, source code and configuration review.

  • Clearly and professionally document root cause and risk analysis of all findings

  • Adhere to the security testing process and raise any gaps or opportunities for improvement with manager.

  • Work closely with the DevOps teams to ensure that the security testing requirements are met and help automate repetitive tasks.

  • Develop understanding of business functionality and apply testing methodology as appropriate to technologies and risks

  • Code and demonstrate basic proof-of-concept exploits of vulnerabilities when required.

  • Assist with coordination of security testing projects according to a structured process, including writing test plans, test cases and test reports.

  • Advise on vulnerability remediation, control implementation and secure development practices

  • Assess product release risk and complexity and identify potential misuse scenarios through review of business requirements and design specifications

  • Assist with tracking, remediation, and risk acceptance for identified security vulnerabilities.

  • Assist in planning, test execution and vulnerability mitigation

  • Ensure that company security policies are implemented, enforced, and enhanced when appropriate

  • Participate in team discussions to formulate new or enhance existing processes and standards

  • Assist in security incident response activities

  • Adhere strictly to compliance and operational risk controls in accordance with company and regulatory standards, policies and practices, report control weaknesses, compliance breaches and operational loss events

  • Run evaluations of new security testing technologies and provide recommendations.

  • Monitor security industry information sources and keep abreast of events, research, and developments.

  • Identify opportunities to improve our processes, quality of the work and efficiencies.

  • Mentor junior team members

  • Other responsibilities as assigned.

Our requirements

  • Strong written and verbal communication skills in English language – used for all formal communication.

  • Ability of critical thinking to form and clearly articulate identified issues and their consequences.

  • Ability to comfortably hold a conversation on cyber security aspects with both technical and non-technical audience.

  • Maintain a wide breadth of penetration testing and/or leadership management skills to a significant degree of depth.

  • Understand the business context/significance of technical penetration testing findings.

  • Consistently output superior quality of deliverables.

  • Poses an entrepreneurial attitude to excel in loosely defined scenarios.

  • Ability to work independently or lead any size team of penetration testers.

  • Time management skills and self-discipline.

  • Be subject matter expert in at least 1 of penetration testing domains (i.e. infrastructure/apps/mobile)..

  • Demonstrated ability to solve complex technical problems.

  • At least 5 years of prior demonstrable hands-on experience in penetration testing.

  • Solid understanding of the platform security models for iOS and Android platforms.

  • Excellent understanding of platform-specific security risks, common vulnerabilities for mobile applications, common risks in financial applications.

  • Practical knowledge of penetration testing of widely understood infrastructure, web and mobile technologies, using manual and automated testing methods.

  • Excellent TCP/IP knowledge and understanding of security implications/issues.

  • Strong web application testing experience.

  • Proven programming/scripting skills.

  • Ability to explain security functionality from first principles.

  • Ability to adapt and apply information to new scenarios and technologies.

  • Strong understanding of applied use of cryptography in application development.

Optional

  • Strong grasp of common technologies, protocols and architectures commonly used by mobile application. (HTML, XML, JavaScript, JSON, REST, Micro-services etc.)

  • Strong understanding of software development lifecycles especially DevOps

  • Experience with dynamic and static application security testing and associated tools

  • Experience with performing security code reviews for Java, Objective C, Swift and Kotlin programming languages

  • Strong initiative, consensus building and ability to collaborate directly with a variety of clients (business, development, compliance, etc.)

  • Experience with mobile security testing frameworks such as OWASP MASVS, OWASP MSTG

  • Knowledge of enterprise application design & common security issues associated with it

  • Advanced knowledge of common security analysis tools and testing techniques especially for the mobile security space

  • Hands-on experience with SAST, DAST, IAST tools and ways to supplement their limitations

  • Knowledge of security verification of mechanisms & technologies such as SSL, Pinning, Biometric Authentication, Out of Band Authentication, JWT, SAML, RASP, Oauth2 etc

  • Prior software programming and development experience especially of iOS & Android platforms is a plus

  • Prior programming experience with Java, Kotlin, Objective C & Swift programming languages would be a plus

  • Prior experience with security testing or secure application development for a large enterprise would be a plus

  • Prior experience with cloud-hosted applications & services would be a plus

  • Experience in reverse engineering or disassembly considered a plus

What we offer

  • Contact with top IT technologies available in the market

  • Employees’ benefits: Multisport Card, private medical and dental health care, life insurance

  • Free parking space for our employees – few minutes from the office

  • Internal training events and workshops

  • Realistic career progression opportunities in an international organization

  • Casual dress code

  • Cultural exchange

  • Benefits

  • sharing the costs of sports activities

  • private medical care

  • sharing the costs of foreign language classes

  • sharing the costs of professional training & courses

  • life insurance

  • remote work opportunities

  • flexible working time

  • integration events

  • corporate sports team

  • doctor’s duty hours in the office

  • retirement pension plan

  • corporate library

  • no dress code

  • video games at work

  • coffee / tea

  • parking space for employees

  • leisure zone

  • extra social benefits

  • employee referral program

  • opportunity to obtain permits and licenses

  • charity initiatives

  • family picnics

  • extra leave

Recruitment stages
1

Phone interview

2

Online assessment

3

Zoom interview

4

Welcome to HSBC!

HSBC Service Delivery (Polska) Sp. z o.o.

HSBC is one of the world’s largest banking and financial services organisations. Our global businesses serve more than 40 million customers worldwide through a network that covers 63 countries and territories.

HSBC Service Delivery (Polska) Sp. z o.o. is HSBC's global finance, operations, risk and technology centre. We use our unique expertise and capabilities to provide specialised services – our people range from technologists transforming the banking experience to operations professionals managing 1.7 trillion payments a year.

Our Purpose – Opening up a world of opportunity – explains why we exist. We are bringing together the people, ideas and capital that nurture progress and growth, helping to create a better world – for our customers, our people, our investors, our communities and the planet we all share.

Scroll to the company’s profile