Senior Security Engineer

Role Purpose:

The Bank is seeking a senior security engineer to strengthen its offensive security capability while contributing to the security of the software delivery pipeline and cloud/AI tooling adoption. The role is anchored in red teaming and penetration testing, with working-level responsibility for DevSecOps and cloud security, and exposure to AI/LLM security as an emerging area.

Note: this role is not evenly split across four disciplines. Candidates should have demonstrable depth in offensive security, with practical (not theoretical) exposure to the others.

Key Responsibilities

Offensive Security — Primary (~40%)

• Plan and execute red team engagements: adversary simulation, C2 infrastructure (Cobalt Strike, Sliver, or similar), campaigns mapped to MITRE ATT&CK
• Conduct penetration testing across web applications, APIs, mobile apps, internal/external network, and wireless
• Design and run social engineering / phishing simulation exercises
• Run purple team exercises in coordination with the SOC/blue team to validate detection coverage
• Produce CBK CORF-aligned findings reports and remediation guidance suitable for regulatory review
• Conduct security assessments, vulnerability assessment and penetration testing on different environments but not restricted to
• Network assessment and penetration testing
• Cloud assessment and penetration testing
• Endpoint assessment and penetration testing
• Application assessment and penetration testing, focusing on Web, API (SOAP and RESTful)
• Mobile assessment and penetration testing
• Align with third party vendors on annual VAPT programs and coordinate with other stakeholders
• Plan and preform adversary simulation campaigns internally and coordinating with third party vendors

DevSecOps — Secondary (~25%)

• Integrate SAST, DAST, and SCA tooling into CI/CD pipelines
• Perform Infrastructure-as-Code security review (Terraform, CloudFormation, ARM templates)
• Conduct secure code review and threat modeling for new applications
• Support container and Kubernetes security hardening

AI Security — Emerging (~35%)

• Conduct adversarial testing of internally deployed AI/LLM tools (prompt injection, data leakage, model behavior under abuse)
• Assess security posture of AI development tooling adopted by engineering teams (e.g., AI coding assistants, MCP integrations)
• Evaluate AI-assisted vulnerability triage/SAST tooling for reliability and false-positive risk

Required Qualifications

• 5–10 years in information security, with demonstrable depth in at least two of the four areas above — not surface-level familiarity with allfour
• At least one recognized offensive security certification: OSCP, OSCE/OSCE3, CRTO, or GPEN.
• Proficiency in scripting/automation: Python, Bash, PowerShell
• Working knowledge of CI/CD tooling: Tekton CI, Jenkins, or Azure DevOps
• Familiarity with regulatory/compliance frameworks relevant to banking (CBK CORF, PCI-DSS, or NIST CSF)

Preferred Qualifications

• Cloud security certification: AWS Security Specialty, Azure Security Engineer Associate, or CKS
• Prior experience in financial services or another regulated industry
• Bug bounty track record or competitive CTF experience
• Exposure to adversarial ML / AI red teaming research

Soft Skills

• Ability to translate technical risk into business/regulatory language for non-technical stakeholders and examiners
• Strong written reporting discipline — findings must be audit-ready without heavy rework