{"id":2430538,"url":"https://alion.io/job/standard-chartered-lead-penetration-testing","title":"Lead, Penetration Testing","company":{"id":20709,"name":"Standard Chartered","domain":"sc.com","url":"https://alion.io/company/standard-chartered-gbs","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Web3","role_family":"Web3","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":23000,"max_usd":48000,"period":"year","method":null,"sample_n":55},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Certora","optional":false},{"name":"CI/CD","optional":false},{"name":"Cucumber","optional":false},{"name":"DeFi","optional":false},{"name":"Echidna","optional":false},{"name":"Foundry","optional":false},{"name":"Git","optional":false},{"name":"Gradle","optional":false},{"name":"JavaScript","optional":false},{"name":"JUnit","optional":false},{"name":"Layer 2","optional":false},{"name":"Manticore","optional":false},{"name":"Maven","optional":false},{"name":"MEV","optional":false},{"name":"Mythril","optional":false},{"name":"Oracle","optional":false},{"name":"Playwright","optional":false},{"name":"Postman","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Rest-Assured","optional":false},{"name":"Scrum","optional":false},{"name":"Selenium","optional":false},{"name":"Shift-Left","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"Slither","optional":false},{"name":"Smart Contracts","optional":false},{"name":"Solidity","optional":false},{"name":"SQL","optional":false},{"name":"TestNG","optional":false},{"name":"Ethereum","optional":true},{"name":"Java","optional":true}],"status":"live","first_seen_at":"2026-10-13T08:52:44Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-13T18:24:50Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Summary\nWe are seeking talented and motivated individuals for the role of Senior Manager / Lead Penetration Testing. Provide deep, hands-on penetration testing expertise for Distributed Ledger Technology (DLT), blockchain, smart contract and API-based solutions. The role independently identifies exploitable security weaknesses, translates technical findings into business risk, and works closely with developers, architects, platform teams and security stakeholders to remediate issues. The role also brings current cyber-security and blockchain industry insight, uses AI-assisted security testing responsibly, applies extensive Java engineering skills to build security and QA automation frameworks, helps QA teams accelerate maintainable test automation, and includes the wider team in technical decisions through evidence-based recommendations and recognised best practices.\nKey Responsibilities\nStrategy and Technical Leadership\nAct as a senior individual contributor and subject-matter expert for penetration testing across smart contracts, APIs, web applications, blockchain platforms and supporting infrastructure.\nDefine risk-based penetration-test approaches covering black-box, grey-box and authenticated testing, aligned to system criticality, threat models and regulatory expectations.\nMaintain deep awareness of emerging cyber threats, blockchain vulnerabilities, attack techniques, defensive controls and relevant industry developments.\nAssess new tools and testing techniques, including AI-assisted approaches, and recommend adoption based on effectiveness, safety, explainability and control requirements.\nBring engineers, security specialists and relevant team members into technical decisions, clearly presenting options, evidence, trade-offs and recommended practices.\nSecurity Testing and Assurance\nPlan and execute end-to-end penetration testing of smart contracts, REST and event-driven APIs, web services, microservices, blockchain nodes, wallets, key-management integrations and supporting cloud or container platforms.\nConduct manual and automated smart contract security testing, including source-code review, static and dynamic analysis, fuzzing, invariant testing and, where appropriate, formal-verification techniques.\nUse smart contract security tools hands-on, including Slither for static analysis, Mythril and Manticore for symbolic execution, Foundry and Echidna for fuzzing and invariant testing, and Certora for formal verification, selecting tools according to the assurance objective and validating all outputs manually.\nCreate and maintain custom Slither detectors, Foundry test suites, Echidna properties and reusable smart contract security test harnesses where standard rules are insufficient.\nTest for blockchain-specific weaknesses such as reentrancy, access-control failures, oracle manipulation, front-running or MEV exposure, flash-loan abuse, unchecked external calls, upgradeability weaknesses, denial of service and cross-chain trust failures.\nPerform API testing covering authentication and authorisation, object-level and function-level access controls, token and session handling, input validation, injection, rate limiting, business-logic abuse, sensitive-data exposure and service-to-service trust.\nAssess common application, network and platform weaknesses using manual exploitation and appropriate tooling, while ensuring testing is authorised, controlled and non-disruptive.\nValidate identified weaknesses, establish realistic attack paths and distinguish exploitable risk from tool-generated noise or false positives. ge and efficiency without weakening professional judgement or accountability.\n\nAI-assisted Penetration Testing\nUse approved AI-enabled security tools to accelerate attack-surface discovery, test-case generation, code and smart-contract review, payload variation, evidence analysis and report preparation.\nApply human validation to all AI-generated findings and recommendations; protect confidential information and ensure use remains within authorised testing scope and organisational policy.\nExplore how adversaries may use AI to find, chain or exploit weaknesses, and incorporate relevant scenarios into controlled security assessments.\nDevelop repeatable automation and AI-assisted workflows that improve coverage and efficiency without weakening professional judgement or accountability.\nJava Engineering and Automation Development\nDemonstrate extensive hands-on coding experience in Java, including strong knowledge of object-oriented design, collections, concurrency, exception handling, secure coding, dependency management, unit testing and reusable framework design.\nDesign and develop maintainable Java-based penetration-testing and QA automation utilities, libraries and frameworks for API, integration, regression and security testing.\nBuild API automation using Java with REST Assured or equivalent frameworks, including authentication, request construction, schema and payload validation, negative testing, response assertions and test-data management.\nDevelop UI automation using Java with Selenium or equivalent approved frameworks, applying Page Object Model, reusable components, robust waits, stable locators and parallel execution patterns.\nUse Java testing ecosystems such as JUnit or TestNG, Maven or Gradle, Cucumber, mock frameworks and reporting libraries, and integrate automated suites with Git-based workflows and CI/CD pipelines.\nReview Java automation code for security, maintainability, test reliability, performance and reuse; coach QA engineers on coding practices, debugging and framework extension.\nResponsibilities\nAI-enabled QA Automation and Enablement\nDemonstrate extensive practical experience using approved generative-AI and coding-assistant tools to accelerate the design, creation, review and maintenance of automated test cases.\nPartner with QA engineers to identify automation opportunities and convert requirements, acceptance criteria, user journeys and API specifications into reusable positive, negative, boundary, regression and security test scenarios.\nHelp QA teams select and apply fit-for-purpose tools, patterns and frameworks for UI, API, contract, integration and regression automation, while avoiding unnecessary tool proliferation.\nCreate reference implementations, reusable prompts, templates, utilities and coding standards that enable QA engineers to develop automation faster and consistently.\nProvide hands-on guidance using enterprise-approved AI coding assistants with frameworks such as Playwright or Selenium for UI testing; Postman/Newman, REST Assured or Karate for API automation; and Cucumber for behaviour-driven test design.\nUse AI to assist with test-case generation, test-data creation, script scaffolding, locator and assertion recommendations, failure analysis, defect summaries and maintenance suggestions, subject to human review and validation.\nIntegrate automated tests into CI/CD pipelines, define quality gates and reporting, and ensure generated tests are traceable to requirements, deterministic, maintainable and suitable for regulated environments.\nCoach QA and development teams on responsible AI usage, including data confidentiality, prompt hygiene, secure coding, intellectual-property considerations and verification of generated outputs.\nRemediation and Engineering Partnership\nWork directly with developers, DevSecOps, architects, product owners and platform teams to explain root cause, exploitation paths, business impact and practical remediation options.\nProvide secure design and coding recommendations for Solidity, APIs, identity, cryptography, secrets, wallets, blockchain integrations and distributed-system trust boundaries.\nRetest fixes, verify closure and identify residual risk, compensating controls or remediation dependencies.\nContribute security test cases and controls to CI/CD pipelines and support shift-left security through threat modelling, design review and developer enablement.\nProduce concise, threat-based reports for technical and senior audiences, with reproducible evidence, severity rationale, remediation ownership and prioritisation.\nSkills and Experience\nExtensive hands-on black-box, grey-box and authenticated penetration testing across applications, APIs, networks and cloud-native platforms; ability to validate exploitability, attack paths and business impact.\nHands-on audits of Solidity/EVM smart contracts; identify reentrancy, access-control, oracle, front-running/MEV, flash-loan, upgradeability, cross-chain and business-logic weaknesses.\nExtensive Java coding for reusable security and QA automation frameworks. Working proficiency in Python and JavaScript for tooling, test automation and blockchain/API testing.\nDesign, develop, review and maintain reliable automated test suites; reusable framework design; positive, negative, boundary, regression and security cases; debugging and code review.\nStrong RESTful API testing methodology; authentication/authorisation, schema/payload validation, negative testing, business logic, rate limits and service-to-service trust.\nQualifications\n\nExtensive use of approved AI coding assistants to accelerate test design, script generation, test data, assertions and failure analysis; validate outputs with human oversight and protect confidential data.\nValidate transaction processing, consensus/finality assumptions, node behaviour, wallet functionality, cryptographic protocols, smart-contract invariants and deterministic behaviour where AI components interact with DLT.\nStrong manual-testing methods; create comprehensive, traceable test strategies, plans, scenarios, cases and evidence; apply risk-based and exploratory testing.\nIntegrate security and functional automation into pipelines; define quality gates, execution reporting, deterministic runs and defect traceability.\nStrong SQL, complex query development and database testing across transactional and integration flows.\nApply threat modelling and current application, API and smart-contract security standards; remain current on cyber, blockchain and DLT threats.\nWork directly with developers, QA, DevSecOps and architects to explain root cause, recommend fixes, retest closure and communicate residual risk to technical and senior audiences.\nRelevant hands-on blockchain/DLT or digital-assets industry experience; senior individual contributor who includes the team in decisions and provides evidence-based recommendations and best practices.\nDesign and execute load, stress and endurance tests; analyse results and isolate application, database, infrastructure or integration bottlenecks.\nPractical familiarity with blockchain development, testing libraries, local networks, oracle integration and blockchain APIs.\nDevelop custom Slither detectors, fuzz properties, invariant suites and formal specifications for critical controls and accounting logic.\nUse platform and observability tools to investigate failures, validate runtime behaviour and support DevSecOps testing.\nTest model-output quality, consistency, safety and real-time behaviour in decentralised workflows; assess how non-deterministic AI outputs are controlled before deterministic smart-contract execution.\nUnderstanding of permissioned and public DLT, DeFi, tokenisation, Layer 2, cross-chain architectures, DAOs and NFTs.\nPractical offensive-security or application-security certification, supplemented by demonstrable hands-on capability.\nAbility to learn new languages, tools and frameworks, share knowledge and support multi-skilling within an agile scrum team.\nAbout Standard Chartered\nWe're an international bank, nimble enough to act, big enough for impact. For more than 170 years, we've worked to make a positive difference for our clients, communities, and each other. We question the status quo, love a challenge and enjoy finding new opportunities to grow and do better than before. If you're looking for a career with purpose and you want to work for a bank making a difference, we wan...","description_format":"text","description_chars":14073,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Continuous learning","Flexible schedule","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Application Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-13T08:52:44Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":4,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-10-13T21:57:39Z"},"pay":null,"html_url":"https://alion.io/job/standard-chartered-lead-penetration-testing","json_url":"https://alion.io/job/standard-chartered-lead-penetration-testing.json","meta":{"generated_at":"2026-10-13T21:57:39Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33537,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":20709},"rest":"https://alion.io/mcp/rest/get_company?id=20709"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstandard-chartered-lead-penetration-testing"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstandard-chartered-lead-penetration-testing"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstandard-chartered-lead-penetration-testing"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/standard-chartered-lead-penetration-testing\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstandard-chartered-lead-penetration-testing"}]}