Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 47 days ago

HSBCJP00058969 (Cybersecurity) Senior Penetration Tester

antalpl1,058 open roles

Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowHSBCJP00058969 (Cybersecurity) Senior Penetration Testerantalpl

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on antalpl's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. antalpl postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 47 days ago

antalpl median: 1 days open

The posting

Senior Penetration Tester

We are looking for an experienced Senior Penetration Tester to join a cybersecurity team responsible for identifying vulnerabilities, assessing security risks and helping engineering teams build more secure applications and services.

In this role, you will perform hands-on security assessments across web applications, APIs, mobile applications, infrastructure and networks. You will combine manual testing, automated security tools, source code and configuration reviews to identify vulnerabilities and demonstrate their potential impact.

The role is highly technical, but also requires strong communication skills. You will work closely with technical and non-technical stakeholders, explain security risks in a clear and practical way, and provide guidance on remediation and secure development.

What you will do

  • Plan and perform penetration tests and security assessments across web, mobile, API, infrastructure and network environments.
  • Conduct hands-on manual testing as well as automated security testing.
  • Identify, validate and assess vulnerabilities and security weaknesses.
  • Develop basic proof-of-concept exploits where required to demonstrate the impact of identified vulnerabilities.
  • Perform source code and configuration reviews to identify security issues.
  • Assess security risks in custom applications and their implementations.
  • Review business requirements and technical designs to identify potential security risks and misuse scenarios.
  • Document findings clearly, including root cause, business impact, risk and recommended remediation.
  • Work closely with engineering and DevOps teams to support vulnerability remediation and secure development practices.
  • Contribute to the automation of repetitive security testing activities.
  • Advise development teams on security controls and appropriate remediation approaches.
  • Support vulnerability tracking, remediation and risk acceptance processes.
  • Prepare test plans, test cases and security assessment reports.
  • Evaluate new security testing technologies and tools and recommend improvements where appropriate.
  • Keep up to date with current vulnerabilities, attack techniques, security research and industry developments.
  • Contribute to improving security testing processes, methodologies and standards.
  • Support security incident response activities when required.
  • Act as a subject matter expert in at least one penetration testing domain.
  • Share knowledge and mentor less experienced penetration testers.
  • Work independently or take ownership of security testing activities involving other testers.

What we are looking for

Essential

  • 3+ years of hands-on penetration testing experience.
  • Strong practical experience in at least one penetration testing domain, such as: Web applications Mobile applications APIs Infrastructure and networks
  • Strong understanding of common vulnerabilities, attack techniques and security testing methodologies.
  • Excellent knowledge of TCP/IP, networking and security protocols.
  • Strong web application security testing experience.
  • Practical experience with both manual and automated security testing.
  • Good programming or scripting skills.
  • Strong analytical and critical-thinking skills.
  • Ability to understand the business impact of technical security findings.
  • Ability to communicate complex security topics clearly to both technical and non-technical audiences.
  • Ability to work independently, manage priorities and take ownership of assigned security assessments.
  • Strong written and spoken English.
  • Ability to solve complex technical problems and adapt to new technologies and scenarios.

Mobile Security – nice to have

Experience with mobile application security testing would be a strong advantage, particularly:

  • Android and/or iOS security models.
  • Common mobile application vulnerabilities and attack techniques.
  • OWASP MASVS and OWASP MSTG.
  • Mobile application testing frameworks and tools.
  • Static and dynamic analysis.
  • Security testing of authentication and authorization mechanisms.
  • SSL/TLS and certificate pinning.
  • Biometric authentication.
  • JWT, OAuth 2.0 and SAML.
  • RASP and other application security controls.
  • Reverse engineering and application disassembly.

Application Security & Development – nice to have

  • Experience with SAST, DAST and IAST tools and understanding of their limitations.
  • Experience with security code reviews.
  • Knowledge of Java, Kotlin, Swift and/or Objective-C.
  • Understanding of software development lifecycles and DevOps practices.
  • Experience testing cloud-hosted applications and services.
  • Understanding of enterprise application architectures and common security issues.
  • Previous software development experience, particularly for Android or iOS, would be an advantage.
  • Experience with technologies such as HTML, XML, JavaScript, JSON, REST and microservices.
  • Understanding of applied cryptography in application development.

Certifications

Professional security certifications are not required, but relevant certifications such as OSCP, OSWE, OSEP, CREST or equivalent will be considered an advantage.

What we offer

  • B2B contract
  • Hybrid working model – 6 days per month from the office in Kraków
  • Private healthcare – Lux Med
  • MyBenefit cafeteria
  • Dedicated support from a Contractor Care Specialist
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against antalpl's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on antalpl's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    antalpl's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.