Penetration Testing Lead (Senior Penetration Tester) – Banking

About the role

BSI is looking for a Penetration Testing Lead to lead security and penetration testing of its core banking platform and its interfaces, and to own the findings through to security sign-off. The engagement runs during the security testing window, about 2.5 months after testing starts on MVP 1, with hypercare and MVP 2 agreed separately.

Key responsibilities

• Agree scope and Rules of Engagement with BSI.
• Lead vulnerability assessment and penetration testing of core banking, APIs and payment interfaces, using OWASP, PTES, NIST 800-115 and CIS, with CVSS-rated findings.
• Review and risk-rate findings, and present results to management and regulators.
• Validate retests of remediated findings and issue security sign-off.
• Direct the Penetration Tester on the team and review their work.

Required profile

• 7+ years in penetration testing, including 3+ years leading engagements for banks or the financial sector.
• Proven penetration testing experience in KSA, preferably for SAMA-regulated entities.
• Working knowledge of the SAMA Cyber Security Framework and NCA ECC.
• Experience testing core banking, APIs and payment interfaces (SWIFT, ISO 20022).

Working conditions

• Hours of 8 per day, Sunday to Thursday, on BSI KSA working days.
• Offsite mobilization of 2 to 4 weeks; onsite mobilization in KSA of 4 to 8 weeks.
• The profile goes into the proposal without the candidate's name; the named person must deliver, or an approved equal or better replacement.