Penetration Tester

Operate and optimize the Security Pipeline within the CI/CD process to integrate security throughout the Software Development Life Cycle (SDLC). Conduct hands-on penetration testing and automate security testing activities. Work closely with Development, Operations, and Security teams to ensure that products meet the security standards of the Company and the Group.

JOB DESCRIPTION

1. DevSecOps & Security Pipeline

• Operate, monitor, and continuously improve the Security Pipeline within CI/CD, ensuring that all Security Gates (SAST, SCA, Secrets Scanning, Container Scanning, and DAST) run reliably and in compliance with established requirements.

• Analyze scan results, eliminate false positives, classify vulnerabilities by severity, and coordinate with Development teams to remediate identified issues.

• Support the implementation of Shift-left Security practices, including Threat Modeling, Secrets Management, and vulnerability management from the development stage.

• Monitor compliance with OWASP Top 10, OWASP ASVS/MASVS, CIS Controls, and internal security policies.

2. Penetration Testing & AI Security Automation

• Conduct penetration testing on Web Applications, Mobile Applications, APIs, and systems within the assigned scope.

• Operate and customize AI Agent Harnesses and AI-powered penetration testing workflows for reconnaissance, testing, vulnerability validation, and report generation.

• Use AI Coding Agents to develop scripts, review source code, process scan results, and automate security workflows.

• Validate AI-generated results and ensure that all testing activities are controlled and conducted strictly within the authorized scope.

3. Infrastructure & Container Security

• Review the security of Infrastructure as Code (IaC), containers, and CI/CD infrastructure; recommend remediation measures and coordinate with Operations teams to address identified issues.

4. Reporting & Continuous Improvement

• Prepare periodic reports on pipeline performance, vulnerability status, and security compliance.

• Recommend automation and AI-driven solutions to reduce testing and vulnerability remediation time, and standardize DevSecOps and penetration testing processes.

REQUIREMENTS

Technical Qualifications

• 1–3 years of experience in DevOps, DevSecOps, or Application Security, preferably with hands-on experience operating CI/CD pipelines (e.g., GitLab CI, Jenkins, GitHub Actions).

• Hands-on experience with SAST, DAST, SCA, Secrets Scanning, and Container Security tools.

• Strong understanding of Web Application and Mobile Application Security, with practical experience in Web/API penetration testing.

• Proficiency in at least one scripting language: Python, Bash, or Go.

• Ability to analyze and validate vulnerabilities and recommend remediation measures to Development teams.

• Experience in highly regulated industries requiring strong security practices, such as finance, banking, fintech

AI & Agent Harness

• Experience using AI Coding Agents for software development, source code analysis, and DevSecOps automation.

• Experience using AI Agent Harnesses for penetration testing, including vulnerability validation, controlled exploitation within an authorized scope, and report generation.

• Ability to validate AI-generated results and understand the security risks associated with the use of AI Agents.

BENEFIT

• Receiving all the benefits as company compensation policy (premium health care insurance, annual travel, etc.).
• Friendly, dynamic working environment, support for career development.
• Joining training courses organized by company.
• Many other benefits when joining us.