Senior Penetration Tester

As a Senior Penetration Tester at HSBC, you will play a critical role in identifying and mitigating security vulnerabilities across the bank’s digital infrastructure. This includes web applications, internal systems, APIs, cloud environments, and network architecture.

Your primary responsibility will be to simulate real-world cyberattacks in a controlled and ethical manner. You will conduct both automated and manual penetration testing to uncover vulnerabilities that could be exploited by attackers.

You will begin engagements by understanding the scope and objectives of the test. This includes identifying target systems, defining testing methodologies, and ensuring compliance with internal policies.

You will perform reconnaissance to gather information about target systems, including domain information, IP ranges, and exposed services. This will be followed by vulnerability scanning using tools such as Nmap, Nessus, or OpenVAS.

After identifying potential vulnerabilities, you will attempt to exploit them using tools such as Metasploit, Burp Suite, or custom scripts. You will test for common vulnerabilities such as SQL injection, cross-site scripting (XSS), authentication bypass, and misconfigurations.

You will also conduct manual testing to identify logic flaws that automated tools may miss. This requires deep understanding of application behavior and attack techniques.

Once testing is complete, you will document your findings in detailed reports. These reports will include vulnerability descriptions, impact analysis, proof-of-concept exploits, and remediation recommendations.

You will work closely with development and IT teams to help fix vulnerabilities and improve security posture.

You will also stay updated with the latest cybersecurity threats, tools, and techniques.

Job Requirements

You must have strong knowledge of networking concepts, including TCP/IP, DNS, firewalls, and VPNs.

Hands-on experience with penetration testing tools such as Burp Suite, Metasploit, Nmap, and Wireshark is required.

You should have a deep understanding of web security vulnerabilities, especially OWASP Top 10.

Experience with scripting languages such as Python, Bash, or PowerShell is important.

Knowledge of operating systems, especially Linux, is essential.

Experience with cloud security testing is a plus.

Certifications such as CEH, OSCP, or similar are highly valued.

Strong analytical thinking, attention to detail, and report writing skills are required.