Lead, Penetration Testing

Job Summary

We are seeking talented and motivated individuals for the role of Senior Manager / Lead Penetration Testing. Provide deep, hands-on penetration testing expertise for Distributed Ledger Technology (DLT), blockchain, smart contract and API-based solutions. The role independently identifies exploitable security weaknesses, translates technical findings into business risk, and works closely with developers, architects, platform teams and security stakeholders to remediate issues. The role also brings current cyber-security and blockchain industry insight, uses AI-assisted security testing responsibly, applies extensive Java engineering skills to build security and QA automation frameworks, helps QA teams accelerate maintainable test automation, and includes the wider team in technical decisions through evidence-based recommendations and recognised best practices.

Key Responsibilities

Strategy and Technical Leadership

• Act as a senior individual contributor and subject-matter expert for penetration testing across smart contracts, APIs, web applications, blockchain platforms and supporting infrastructure.
• Define risk-based penetration-test approaches covering black-box, grey-box and authenticated testing, aligned to system criticality, threat models and regulatory expectations.
• Maintain deep awareness of emerging cyber threats, blockchain vulnerabilities, attack techniques, defensive controls and relevant industry developments.
• Assess new tools and testing techniques, including AI-assisted approaches, and recommend adoption based on effectiveness, safety, explainability and control requirements.
• Bring engineers, security specialists and relevant team members into technical decisions, clearly presenting options, evidence, trade-offs and recommended practices.

Security Testing and Assurance

• Plan and execute end-to-end penetration testing of smart contracts, REST and event-driven APIs, web services, microservices, blockchain nodes, wallets, key-management integrations and supporting cloud or container platforms.
• Conduct manual and automated smart contract security testing, including source-code review, static and dynamic analysis, fuzzing, invariant testing and, where appropriate, formal-verification techniques.
• Use smart contract security tools hands-on, including Slither for static analysis, Mythril and Manticore for symbolic execution, Foundry and Echidna for fuzzing and invariant testing, and Certora for formal verification, selecting tools according to the assurance objective and validating all outputs manually.
• Create and maintain custom Slither detectors, Foundry test suites, Echidna properties and reusable smart contract security test harnesses where standard rules are insufficient.
• Test for blockchain-specific weaknesses such as reentrancy, access-control failures, oracle manipulation, front-running or MEV exposure, flash-loan abuse, unchecked external calls, upgradeability weaknesses, denial of service and cross-chain trust failures.
• Perform API testing covering authentication and authorisation, object-level and function-level access controls, token and session handling, input validation, injection, rate limiting, business-logic abuse, sensitive-data exposure and service-to-service trust.
• Assess common application, network and platform weaknesses using manual exploitation and appropriate tooling, while ensuring testing is authorised, controlled and non-disruptive.
• Validate identified weaknesses, establish realistic attack paths and distinguish exploitable risk from tool-generated noise or false positives. ge and efficiency without weakening professional judgement or accountability.

AI-assisted Penetration Testing

• Use approved AI-enabled security tools to accelerate attack-surface discovery, test-case generation, code and smart-contract review, payload variation, evidence analysis and report preparation.
• Apply human validation to all AI-generated findings and recommendations; protect confidential information and ensure use remains within authorised testing scope and organisational policy.
• Explore how adversaries may use AI to find, chain or exploit weaknesses, and incorporate relevant scenarios into controlled security assessments.
• Develop repeatable automation and AI-assisted workflows that improve coverage and efficiency without weakening professional judgement or accountability.

Java Engineering and Automation Development

• Demonstrate extensive hands-on coding experience in Java, including strong knowledge of object-oriented design, collections, concurrency, exception handling, secure coding, dependency management, unit testing and reusable framework design.
• Design and develop maintainable Java-based penetration-testing and QA automation utilities, libraries and frameworks for API, integration, regression and security testing.
• Build API automation using Java with REST Assured or equivalent frameworks, including authentication, request construction, schema and payload validation, negative testing, response assertions and test-data management.
• Develop UI automation using Java with Selenium or equivalent approved frameworks, applying Page Object Model, reusable components, robust waits, stable locators and parallel execution patterns.
• Use Java testing ecosystems such as JUnit or TestNG, Maven or Gradle, Cucumber, mock frameworks and reporting libraries, and integrate automated suites with Git-based workflows and CI/CD pipelines.
• Review Java automation code for security, maintainability, test reliability, performance and reuse; coach QA engineers on coding practices, debugging and framework extension.

Responsibilities

AI-enabled QA Automation and Enablement

• Demonstrate extensive practical experience using approved generative-AI and coding-assistant tools to accelerate the design, creation, review and maintenance of automated test cases.
• Partner with QA engineers to identify automation opportunities and convert requirements, acceptance criteria, user journeys and API specifications into reusable positive, negative, boundary, regression and security test scenarios.
• Help QA teams select and apply fit-for-purpose tools, patterns and frameworks for UI, API, contract, integration and regression automation, while avoiding unnecessary tool proliferation.
• Create reference implementations, reusable prompts, templates, utilities and coding standards that enable QA engineers to develop automation faster and consistently.
• Provide hands-on guidance using enterprise-approved AI coding assistants with frameworks such as Playwright or Selenium for UI testing; Postman/Newman, REST Assured or Karate for API automation; and Cucumber for behaviour-driven test design.
• Use AI to assist with test-case generation, test-data creation, script scaffolding, locator and assertion recommendations, failure analysis, defect summaries and maintenance suggestions, subject to human review and validation.
• Integrate automated tests into CI/CD pipelines, define quality gates and reporting, and ensure generated tests are traceable to requirements, deterministic, maintainable and suitable for regulated environments.
• Coach QA and development teams on responsible AI usage, including data confidentiality, prompt hygiene, secure coding, intellectual-property considerations and verification of generated outputs.

Remediation and Engineering Partnership

• Work directly with developers, DevSecOps, architects, product owners and platform teams to explain root cause, exploitation paths, business impact and practical remediation options.
• Provide secure design and coding recommendations for Solidity, APIs, identity, cryptography, secrets, wallets, blockchain integrations and distributed-system trust boundaries.
• Retest fixes, verify closure and identify residual risk, compensating controls or remediation dependencies.
• Contribute security test cases and controls to CI/CD pipelines and support shift-left security through threat modelling, design review and developer enablement.
• Produce concise, threat-based reports for technical and senior audiences, with reproducible evidence, severity rationale, remediation ownership and prioritisation.

Skills and Experience

Extensive hands-on black-box, grey-box and authenticated penetration testing across applications, APIs, networks and cloud-native platforms; ability to validate exploitability, attack paths and business impact.

Hands-on audits of Solidity/EVM smart contracts; identify reentrancy, access-control, oracle, front-running/MEV, flash-loan, upgradeability, cross-chain and business-logic weaknesses.

Extensive Java coding for reusable security and QA automation frameworks. Working proficiency in Python and JavaScript for tooling, test automation and blockchain/API testing.

Design, develop, review and maintain reliable automated test suites; reusable framework design; positive, negative, boundary, regression and security cases; debugging and code review.

Strong RESTful API testing methodology; authentication/authorisation, schema/payload validation, negative testing, business logic, rate limits and service-to-service trust.

Qualifications

Extensive use of approved AI coding assistants to accelerate test design, script generation, test data, assertions and failure analysis; validate outputs with human oversight and protect confidential data.

Validate transaction processing, consensus/finality assumptions, node behaviour, wallet functionality, cryptographic protocols, smart-contract invariants and deterministic behaviour where AI components interact with DLT.

Strong manual-testing methods; create comprehensive, traceable test strategies, plans, scenarios, cases and evidence; apply risk-based and exploratory testing.

Integrate security and functional automation into pipelines; define quality gates, execution reporting, deterministic runs and defect traceability.

Strong SQL, complex query development and database testing across transactional and integration flows.

Apply threat modelling and current application, API and smart-contract security standards; remain current on cyber, blockchain and DLT threats.

Work directly with developers, QA, DevSecOps and architects to explain root cause, recommend fixes, retest closure and communicate residual risk to technical and senior audiences.

Relevant hands-on blockchain/DLT or digital-assets industry experience; senior individual contributor who includes the team in decisions and provides evidence-based recommendations and best practices.

Design and execute load, stress and endurance tests; analyse results and isolate application, database, infrastructure or integration bottlenecks.

Practical familiarity with blockchain development, testing libraries, local networks, oracle integration and blockchain APIs.

Develop custom Slither detectors, fuzz properties, invariant suites and formal specifications for critical controls and accounting logic.

Use platform and observability tools to investigate failures, validate runtime behaviour and support DevSecOps testing.

Test model-output quality, consistency, safety and real-time behaviour in decentralised workflows; assess how non-deterministic AI outputs are controlled before deterministic smart-contract execution.

Understanding of permissioned and public DLT, DeFi, tokenisation, Layer 2, cross-chain architectures, DAOs and NFTs.

Practical offensive-security or application-security certification, supplemented by demonstrable hands-on capability.

Ability to learn new languages, tools and frameworks, share knowledge and support multi-skilling within an agile scrum team.

About Standard Chartered

We're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we want to hear from you. You can count on us to celebrate your unique talents and we can't wait to see the talents you can bring us.

Our purpose, to drive commerce and prosperity through our unique diversity, together with our brand promise, to be here for good are achieved by how we each live our valued behaviours. When you work with us, you'll see how we value difference and advocate inclusion.

Together we:

• Do the right thing and are assertive, challenge one another, and live with integrity, while putting the client at the heart of what we do
• Never settle, continuously striving to improve and innovate, keeping things simple and learning from doing well, and not so well
• Are better together, we can be ourselves, be inclusive, see more good in others, and work collectively to build for the long term

What we offer

In line with our Fair Pay Charter, we offer a competitive salary and benefits to support your mental, physical, financial and social wellbeing.

• Core bank funding for retirement savings, medical and life insurance, with flexible and voluntary benefits available in some locations.
• Time-off including annual leave, parental/maternity (20 weeks), sabbatical (12 months maximum) and volunteering leave (3 days), along with minimum global standards for annual and public holiday, which is combined to 30 days minimum.
• Flexible working options based around home and office locations, with flexible working patterns.
• Proactive wellbeing support through Unmind, a market-leading digital wellbeing platform, development courses for resilience and other human skills, global Employee Assistance Programme, sick leave, mental health first-aiders and all sorts of self-help toolkits
• A continuous learning culture to support your growth, with opportunities to reskill and upskill and access to physical, virtual and digital learning.
• Being part of an inclusive and values driven organisation, one that embraces and celebrates our unique diversity, across our teams, business functions and geographies - everyone feels respected and can realise their full potential.