Senior Penetration Tester (Mobile)

For an international financial institution, we are looking for an experienced Senior Penetration Tester (Mobile) to join the Offensive Security team and take a leading role in the area of mobile and web/API application security.

We offer

• A stable, long-term contract in an international banking environment with mature security standards.
• Real impact on the security architecture of products used by millions of users.
• Work in a fully remote model with a flexible approach.

Daily tasks

• Independent planning and execution of advanced penetration tests (manual and using tools), with a particular emphasis on mobile applications (iOS / Android), Web, and API.
• Vulnerability verification, elimination of false-positives, and creating secure Proof of Concept (PoC) demonstrations.
• Developing technical and management reports along with recommendations for secure fixes (remediation guidance).
• Conducting re-tests and validating fixes implemented by development teams.
• Developing internal playbooks, scripts, and automation of testing processes.
• Mentoring and technical support for less experienced team members.

Requirements

• Active OSCP certificate (mandatory condition).
• Rich practical experience in penetration testing of mobile applications (Android / iOS) and a solid background in the Web / API application area (OWASP MASVS, OWASP Top 10 methodologies).
• Ability to write scripts and automate tests (e.g., Python, Bash).
• Fluency in English, both spoken and written (working in an international team, reporting in English).
• Readiness to undergo a standard pre-employment verification process (Background Check) and collect equipment at the Warsaw office.

Nice to have

• Experience in security testing of solutions based on Blockchain / Web3.
• Additional industry certificates in the mobile/web area (e.g., OSWE, eWPTX, eMAPT, Burp Suite Certified Practitioner).
• Knowledge of cloud security issues (AWS / Azure / GCP) or Active Directory.

Must have: OSCP, Android, iOS, API, OWASP, Python, Bash

Nice to have: Blockchain, Web3, OSWE, Burp Suite, AWS, Azure, GCP, Active Directory