Senior Penetration Tester

Key Responsibilities

• Comprehensive Penetration Testing: Lead and execute advanced, end-to-end penetration tests across TT’s entire technology ecosystem, including complex web applications, microservices, REST/WebSocket APIs, internal network infrastructure, and thick-client trading applications.
• Cloud & DevOps Security: Conduct targeted assessments against our cloud infrastructure (e.g., AWS, GCP) and containerized environments. Actively test and identify misconfigurations or vulnerabilities within our CI/CD pipelines to secure our software supply chain.
• Infrastructure & Active Directory: Execute internal network penetration tests, including advanced Active Directory abuse and exploitation (e.g., Kerberoasting, lateral movement, privilege escalation) to identify internal structural weaknesses.
• Actionable Reporting: Produce comprehensive, high-quality technical reports that clearly articulate vulnerabilities, demonstrate business impact via proof-of-concepts (PoCs), and provide realistic, actionable remediation guidance for engineering teams.
• Remediation Support: Partner with the Offensive Security Manager and Engineering teams to validate fixes, provide technical clarity on vulnerabilities, and participate in threat modeling or architectural reviews as a subject matter expert.
• Tooling & Automation: Develop custom scripts, exploits, or automation tools to streamline internal penetration testing methodologies and improve the efficiency of the Offsec team.
• Technical Mentorship: Serve as a technical leader within the team, mentoring junior/mid-level testers, sharing cutting-edge research, and elevating the team's overall technical proficiency.

Skills, Knowledge and Expertise

• Extensive Experience: 7+ years of hands-on experience in penetration testing, offensive security, or red teaming.
• Application & API Expertise: Deep understanding of modern web application and API vulnerabilities (OWASP Top 10, CWEs), authentication protocols (OAuth, SAML), and testing methodologies.
• Infrastructure Mastery: Proven experience with network penetration testing, bypassing network segmentation, and conducting complex Active Directory exploitation (using tools like BloodHound, Impacket, Mimikatz, etc.).
• Cloud & CI/CD Proficiency: Strong understanding of cloud-native architectures, containerization (Docker, Kubernetes), and experience finding security flaws in DevOps pipelines (GitLab, GitHub Actions, Jenkins, etc.).
• Tooling & Scripting: Expert-level proficiency with industry-standard offensive tools (e.g., Burp Suite Pro, Metasploit, Cobalt Strike, Nmap). Strong programming/scripting abilities in Python, Bash, Go, or PowerShell to write custom tooling or modify exploits.
• Communication Skills: Exceptional ability to translate highly technical findings into clear, business-focused risks for both technical and non-technical stakeholders.

• Industry Certifications: Highly regarded offensive security certifications such as OSCP, OSWE, OSEP, CRTO, GXPN, or equivalent.
• FinTech Experience: Previous experience testing high-frequency trading platforms, financial technology, or heavily regulated environments.
• Community Involvement: A track record of independent vulnerability research, published CVEs, active bug bounty participation, or speaking engagements at security conferences (DEFCON, Black Hat, BSides).

Benefits

• Health & Financial Security:
  • Medical, Dental, and Vision coverage
• Time Off & Flexibility:
  • Enjoy the best of both worlds: the energy and collaboration of in-person work, combined with the convenience and focus of remote days. This is a hybrid position requiring three days of in-office collaboration per week, with the flexibility to work remotely for the remaining two days. Our hybrid model is designed to balance individual flexibility with the benefits of in-person collaboration, enhanced team cohesion, spontaneous innovation, hands-on mentorship opportunities and strengthens our company culture.
  • 21 days of Paid Time Off (PTO) per year, with the option to roll over unused days.
  • One dedicated day per year for volunteering.
  • Two professional development days per year to allow uninterrupted professional development.
  • An additional PTO day is added during milestone anniversary years.
  • Robust paid holiday schedule with early dismissal.
  • Generous parental leave for all parents (including adoptive parents).
• Work-Life Support & Resources:
  • Budget for tech accessories, including monitors, headphones, keyboards, and other office equipment.
  • Milestone anniversary bonuses.
• Wellness & Lifestyle Perks:
  • Subsidy contributions toward gym memberships and health/wellness initiatives.
• Our Culture:
  • Forward-thinking, culture-based organization with collaborative teams that promote diversity and inclusion.
    

About
Trading Technologies is a Software-as-a-Service (SaaS) technology platform provider to the global capital markets industry. The company’s award-winning TT® platform connects to the world’s major international exchanges and liquidity venues in listed derivatives alongside a growing number of asset classes, including fixed income and cryptocurrencies. The TT platform delivers advanced tools for trade execution and order management, market data solutions, analytics, trade surveillance, risk management, and infrastructure services to the world’s leading sell-side institutions, buy-side firms, and exchanges. The company’s blue-chip client base includes Tier 1 banks as well as brokers, money managers, hedge funds, proprietary traders, Commodity Trading Advisors (CTAs), commercial hedgers, and risk managers. These firms rely on the TT ecosystem to manage their end-to-end trading operations. In addition, exchanges utilize TT’s technology to deliver innovative solutions to their market participants. TT also strategically partners with technology companies to make their complementary offerings available to Trading Technologies’ global client base through the TT ecosystem.