Security Vulnerability and Penetration Testing Engineer

Baker McKenzie

9d•Hybrid

About The Position

The Security Vulnerability and Penetration Testing (VAPT) Engineer oversees and serves as a technical resource for all assessment activity related to the security posture of existing and proposed firm systems, platforms, and processes to protect and continually improve the confidentiality, integrity, and availability of information systems in accordance with the firm's business objectives, regulatory requirements, and strategic goals. As the VAPT Engineer, you will lead security penetration testing activities across the firm's systems, platforms, and applications. Acting as the Subject Matter Expert (SME) for the VAPT function, you will own and manage core VAPT tools, platforms, and processes. You will deliver clear, audience-appropriate technical assessment reports and provide practical, actionable recommendations based on sound cybersecurity and risk management principles.

Requirements

Commanding knowledge of VAPT concepts and best practices, including the requirements for WhiteHat/ethical hacking.
Expert understanding of the difference between a vulnerability assessment and a penetration test in the context of assessment scope, objectives, and deliverables.
Extensive experience with common automated VAPT tools such as Nessus, Appscan, Burp Suite, Nipper, and Trustwave.
Expertise with common attack tools and frameworks such as Wireshark, Kali, and Metasploit, etc.
Expertise with mobile platform security technology, including vulnerability identification and exploitation tools as well as mobile platform security best practices, frameworks, etc.
Ability to validate the presence of identified vulnerabilities with accuracy.
Mastery of common application platforms and technologies in order to effectively understand and evaluate complex application assessments via the use of manual techniques and simple tools such as proxies and browser plugins.
Authoritative mastery of OWASP, CVE, general security controls, and other foundational topics such as the latest application and operating system exploits.
Ongoing commitment to understanding the threat landscape and common adversary motivations/practices.
Ability to quickly adapt practices to evolving circumstances.
Strong written and oral communication skills.
Ability to convey complex concepts to non-technical constituents.
Proficiency in oral and written English.
Possess a Computer Science Bachelor’s Degree or substantial equivalent experience.
CISSP required.
Offensive Security OSCP required.

Nice To Haves

Expert knowledge of common scripting and programming languages is advantageous.
Experience of in API testing methodologies highly desirable.
Demonstratable experience of using AI to enhance the penetration testing and risk assessment of AI-enabled applications and agents.
GIAC GPEN, GAIPT or GWAPT preferred.

Responsibilities

Lead security penetration testing activities across the firm's systems, platforms, and applications.
Act as the Subject Matter Expert (SME) for the VAPT function.
Own and manage core VAPT tools, platforms, and processes.
Deliver clear, audience-appropriate technical assessment reports.
Provide practical, actionable recommendations based on sound cybersecurity and risk management principles.
Assist with the preparation of internal training materials and documentation.
Maintain critical thinking and composure under pressure.
Be productive and maintain focus without direct supervision.
Understand VAPT in the context of risk management and organizational priorities.
Be passionate in the practice and pursuit of VAPT excellence.