Senior Security Engineer

About the role

The Bank is looking for a Senior Security Engineer to lead offensive security initiatives, strengthen DevSecOps practices, and shape emerging AI/LLM security capabilities. The role focuses on red‑team engagements, cloud security, and integration of security tooling into the software delivery pipeline.

Key responsibilities

• Plan and execute red‑team and adversary‑simulation campaigns using C2 frameworks such as Cobalt Strike or Sliver, aligned with MITRE ATT&CK.
• Conduct penetration testing across web, API, mobile, network, wireless, cloud, and endpoint environments.
• Design and run social‑engineering and phishing simulations, and coordinate purple‑team exercises with SOC/blue teams.
• Integrate SAST, DAST, and SCA tools into CI/CD pipelines (Tekton CI, Jenkins, Azure DevOps).
• Perform IaC security reviews for Terraform, CloudFormation, and ARM templates, and support container/Kubernetes hardening.
• Assess and test AI/LLM tools for prompt injection, data leakage, and model abuse, and evaluate AI‑assisted security tooling.
• Produce regulatory‑ready findings reports (CBK CORF, PCI‑DSS, NIST CSF) and collaborate with third‑party VAPT providers.

Required profile

• 5–10 years of information security experience with deep expertise in at least two of the listed domains.
• Offensive security certification (OSCP, OSCE/OSCE3, CRTO, or GPEN).
• Familiarity with banking‑related compliance frameworks (CBK CORF, PCI‑DSS, NIST CSF).

Required skills

• Python, Bash, PowerShell scripting.
• Cobalt Strike, Sliver (C2 frameworks).
• SAST, DAST, SCA tooling.
• Tekton CI, Jenkins, Azure DevOps.
• Terraform, CloudFormation, ARM templates.
• Kubernetes, Docker container security.
• AI/LLM security testing techniques.