Middle/Senior Penetration Testing Engineer

About the role

GEM Corp is looking for an experienced Middle/Senior Penetration Testing Engineer to identify and assess security vulnerabilities across its digital banking platform, including web and mobile applications, APIs, backend services and cloud infrastructure. The role covers banking-specific business logic, collaboration with engineering teams to fix issues, and strengthening the platform's security posture in line with industry standards and regulatory requirements.

Key responsibilities

• Plan and run penetration tests on web apps, mobile apps, APIs, backend services, cloud infrastructure and internal networks
• Test authentication, authorization and session flows, including digital onboarding, eKYC, transaction authorization and multi-factor journeys
• Assess banking business logic vulnerabilities such as account opening, deposits, lending, card issuance, limits, fees and rewards
• Write clear, reproducible reports with proof of concept, realistic risk ratings and practical remediation guidance
• Work with engineering teams to validate fixes and help them understand the root cause
• Contribute to threat modelling, secure design reviews, secure code reviews and CI/CD pipeline coverage of SAST, DAST, SCA and secret scanning
• Support client-led and third-party tests, respond to findings and prepare evidence for client assessments and regulatory reviews
• Build internal tooling, test harnesses and attack playbooks, track emerging threats and contribute to red team and purple team exercises

Required profile

• 3+ years of hands-on penetration testing or offensive security experience
• Strong track record testing web apps and APIs against OWASP Top 10
• Mobile app security testing on iOS and Android, including reverse engineering and bypassing client-side controls
• Cloud security testing (AWS, Azure or GCP)
• Ability to read code and find vulnerabilities at source (Java, Kotlin, Go, TypeScript, Swift or similar)
• Excellent report writing and communication with engineers and non-technical stakeholders
• Nice to have: banking, payments or fintech testing experience; OWASP ASVS, MASVS, SAMM, MITRE ATT&CK and PTES knowledge; regulatory frameworks such as MAS TRM, PCI DSS, ISO 27001, SOC 2; payment and card security (HSM, 3-D Secure, tokenisation); red team, DFIR or published CVEs, bug bounties, CTF or certifications

Required skills

• Burp Suite, Nmap, Metasploit, Frida, Objection, MobSF, BloodHound, Nuclei
• Scripting in Python, Go, Bash or similar
• OWASP Top 10, OWASP ASVS, MASVS, SAMM, MITRE ATT&CK, PTES

What we offer

• Salary open to negotiation, with probation salary at 100% of the official salary
• 13th-month salary and two annual performance reviews
• Bonus for special occasions and project bonus
• Certification and training allowances, health care insurance and annual health assessment
• Summer trips and team-building activities
• Five-day work week with flexible check-in time