Senior Penetration Tester, Tandem

• Web Application & API Testing
• Mobile Application Security Testing (Android & iOS)
• Network Infrastructure Testing
• Cloud Security Testing (AWS & Azure)
• Proven track record in leading Red Team engagements
• Strong knowledge of social engineering tactics and experience in executing complex phishing and physical assessments
• Experience with Digital Forensics and Threat Intelligence integration
• Ability to collaborate effectively with cross-functional teams and stakeholders
• Strong understanding of attack vectors, threat landscapes, and security best practices

Desirable

• The primary responsibility of the Senior Penetration Tester is to lead and execute comprehensive penetration testing activities across various digital platforms and environments
• This role will encompass testing web applications, APIs, mobile applications, network infrastructure, and cloud platforms (AWS and Azure)
• Additionally, the role will involve contributing to the overall security strategy, particularly focusing on offensive and defensive security operations, threat intelligence and modelling
• The successful candidate will play a critical role in improving Tandem Bank’s security posture, working collaboratively with Security Operations to identify, mitigate, and remediate vulnerabilities, and assist in refining security protocols and best practices
• Conduct penetration tests on web applications, APIs, and mobile applications (Android & iOS)
• Perform infrastructure security assessments of network environments and cloud platforms (AWS & Azure)
• Review Firewall and Switch rules and ACLs
• Lead in Red Team exercises to assess defensive measures and identify security weaknesses
• Execute social engineering campaigns, including complex phishing simulations and physical security tests
• Collaborate with internal teams to define remediation strategies for identified vulnerabilities
• Support forensic investigations and contribute to incident response activities
• Stay updated on the latest security trends, vulnerabilities, and penetration testing methodologies
• Contribute to the development of security processes, procedures, and best practices to strengthen the security posture of Tandem Bank
• Prepare detailed reports for both technical teams and executive stakeholders, articulating vulnerabilities, and recommended remediation
• Design Cyber Security Solutions that align with existing IT infrastructure, industry best practices, and cutting-edge technologies
• Install, configure, and support Cyber Security systems that enforce corporate Information Security policies
• Collaborate with Technical Leads to seamlessly integrate Cyber Security systems into current IT and network infrastructure
• Define Information Security Requirements for IT projects and infrastructure
• Proactively identify and remediate security gaps
• Maintain the security level of networks (Cloud and On-Premises), IT systems, and software applications
• Document Cyber Security solutions with both high-level and detailed designs
• Keep abreast of industry trends and emerging technologies in Cyber Security
• Actively participate in the definition and assessment of Information Security Controls
• Actively participate in the drafting and development of Issues and Actions detailing Control Gaps and remediation plans
• Actively track progress, updating issues and actions as required
• Assist in the development of monthly reporting packs and Information Security Position Papers
• Assist in the co-ordination and assessment, documentation, and deployment of IDAM, DLP, tooling
• Assist in the co-ordination and assessment of our SDLC requirements
• Ensure the regular delivery of control uplift projects in accordance with Agile methodologies
• Work with Stakeholders to define roadmaps and prioritize work for any control gap identified
• Manage the end-to-end delivery of uplift activities
• Creating a delivery focused and high performing environment, through leading by example and a commitment to continuous improvement
• Working Pattern: Monday to Friday, 36.25 hours per week
• The role will report to the Head of Information Security, and you will be joining a team of committed security resources focused on Information Security, Cloud Security, Governance, Risk, and Compliance
• Through ongoing assessment and review working collaboratively with our Service Delivery, Infrastructure, Platforms and Engineering teams work to manage and continually improve security posture