VAPT Senior Executive

External

Hlb · Pjc-pj City

Full-timeOn-siteToday

AWSAzureCI/CDCloud SecurityComplianceDocumentation

Cover Letter Connect

Prepare for this interview

Elite

AI-generated questions, company research, and talking points tailored to this role

About the role

The Senior Executive, VAPT delivers hands-on offensive security testing. You will identify and validate weaknesses across the bank's digital landscape by executing penetration tests, vulnerability scans and red- teaming exercises against critical infrastructure and financial apps. In this technical role, you manage the end-to-end testing lifecycle from scoping to final reporting. You will translate complex vulnerabilities into actionable risk insights while ensuring compliance with BNM RMiT. You act as a technical gatekeeper for new products, cloud migrations and third-party integrations before they enter production. You will partner with Security, App and Business teams to track remediation and ensure gaps are closed precisely. By integrating testing into CI/CD pipelines, you will drive a Shift Left culture to secure the bank's reputation and market standing.

Responsibilities

Operational (50%)

Vulnerability & Testing Management: Participate end-to-end scanning and penetration testing (web, mobile, network) across the Group, prioritizing high-risk findings for remediation.

Operational Execution: Deliver security testing and special projects as assigned by team lead.

Audit & Regulatory Support: Prepare technical documentation and evidence for queries from auditors and BNM regarding security findings.

Risk Identification: Proactively identify and report critical security gaps that remain unaddressed by current controls.

Remediation Validation: Monitor and validate security gap closures to ensure compliance with Group SLAs and regulatory mandates.

Continuous Improvement: Suggest enhancements for security controls and software processes based on vulnerability trends.

Standard Maintenance: Assist in drafting and updating group-wide security procedures and ethical hacking standards.

Executive Reporting: Work with team lead to compile and present risk-based findings and remediation progress to senior management and IT Security Committees.

Vendor Oversight: Work with team lead to manage third-party security providers for mandatory assessments (Annual Pentests, PCI ASV) and oversee software licensing budgets.

Incident Support: Conduct impact assessments on system changes and provide offensive expertise during incident investigations to identify entry points.

Workflow Automation: Develop automated VAPT scripts and tools to improve testing efficiency.

Tooling Optimization: Work with team lead to deploy and tune Group VAPT tools (DAST, SAST, IAST) and automate attack surface management.

Technical (50%)

Technical Advisory: Provide hands-on VAPT technical assistance and troubleshooting for business units and branches.

Assurance: Conduct quality reviews on all internal/vendor VAPT reports to ensure technical depth and actionable remediation.

Attack Surface Design: Identify security blind spots in complex architectures and translate them into robust Group-wide testing scenarios.

Mitigation Analysis: Work with team lead to explain complex exploit chains to application owners and provide permanent mitigation strategies to prevent external breaches.

Emerging Threat Research: Evaluate new exploitation techniques (e.g., AI-driven attacks) and recommend defensive shifts to maintain Group resilience.

Security Validation: Collaborate with architects and software developers to execute security-by-design testing for regional products, ensuring alignment with established VAPT playbooks and standards.

Stakeholder & Team Collaboration: Work closely with Cyber Defense and App Security teams to align daily testing activities with the broader Group Technology strategy.

Risk Remediation Tracking: Conduct technical risk assessments of discovered flaws and track the remediation lifecycle across regional platforms to ensure gaps are closed.

Skills & Experience We Are Looking For:

Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, or a related field.

Must possess at least one or more of the following: OSCP, CISA, GPEN, or equivalent industry-recognized security certification for hacking and/or VAPT.

3 to 5 years of experience in Vulnerability Management or Penetration Testing.

Expertise in BNM RMiT (Risk Management in Technology) and PCI-DSS 4.0 standards.

Must have a strong understanding of industry-standard penetration testing methodologies, including:

OSSTMM, OWASP, PTES and others.

Hands-on experience managing VA tools such as Tenable, Rapid7 InsightVM, Qualys and others.

Experience managing vulnerability lifecycles within enterprise ticketing platforms such as ServiceNow.

Expertise in cloud security (AWS, Azure, GCP) and on-prem security controls.

Special Skills

Experienced in manual exploitation techniques for web applications, including deep-dive testing for complex business logic flaws, API security, and session management vulnerabilities.

Experienced in manual security assessments for Mobile Applications (iOS/An

VAPT Senior Executive

About the role

Responsibilities

Additional Information

Your Match

Company Intel

What employees say

Interested in this role?