IBKR), a member of the S&P; 500, is a global financial services company headquartered in Greenwich, Connecticut, with offices in over 15 countries. For more than four decades, Interactive Brokers has focused on technology, automation, and innovation to provide clients worldwide with a sophisticated, unified platform to manage their investment portfolios. We serve individual investors, hedge funds, proprietary trading groups, financial advisors, and introducing brokers.

We look for individuals who are intellectually curious, collaborative, and motivated to contribute to technology that helps simplify and enhance access to global financial markets. We are looking for a Senior Penetration Tester who combines strong offensive testing skills with deep application security and secure code review expertise. This role is for someone who doesn't just test applications from the outside — you can read and reason about source code like a developer, trace vulnerable logic from input to sink, and then convert those code-level findings into real, working security test cases and exploits that prove impact end-to-end. You'll own full-cycle assessments: black-box testing, white-box/source-assisted review, and validation — tying it all together into a coherent risk narrative for engineering and leadership, with an attacker's mindset applied throughout. Exposure to broader red team operations is a plus and will allow you to extend application-layer footholds into wider adversary simulation scenarios.

Application Penetration Testing (Black-box & White-box)

Plan, scope, and execute end-to-end penetration tests on web applications, APIs, and mobile apps using both black-box and source-assisted (white-box) methodologies.

Perform full attack-surface mapping, auth flows, session management, API contracts, business logic, access control boundaries - before diving into exploitation.

IDOR + broken auth account takeover; SSRF internal pivot sensitive data exposure).

Manual Secure Code Review

Conduct manual, in-depth secure code reviews across languages such as Java, Python, JavaScript/TypeScript (Node.js), Go, C#, and PHP — going beyond automated scanner output.

Trace data flow from source (user input, external API, file upload, etc.) to sink (DB query, deserialization, template engine, OS command, file system, etc.)



Identify vulnerability classes including injection attacks (SQL, NoSQL, Command, LDAP, XXE), insecure deserialization, authentication and session flaws, IDOR and broken access control, SSRF, race conditions, cryptographic misuse, and business logic flaws.

Turning Code Findings into Working Security Tests

Develop custom scripts/tools (Python, Go, Bash) to weaponize and automate exploitation of identified code patterns across the codebase (e.g., Translate secure code review findings into repeatable regression security tests that can be reused across engagements and retesting cycles to catch reintroduction of the same bug class.

Bridge the gap between 'this line of code looks dangerous' and 'here's the request/script/payload that proves it,' making findings actionable and unambiguous for developers.

Go beyond automated scan output — treat static/dynamic analysis as a recon and target-prioritization step, then manually validate and weaponize findings into working exploits, the way an attacker would triage a leaked or decompiled codebase.

an SSRF, exposed internal endpoint, or leaked credential from source code) as an entry point into broader adversary simulation — pivoting from app compromise toward internal network or Active Directory attack paths where in scope.

Apply working knowledge of C2 concepts (beaconing, traffic patterns, evasion) to understand how an application-layer compromise could realistically be leveraged for persistence or lateral movement in a full red team engagement.

Author clear, detailed technical reports that connect the dots: vulnerable code snippet proof-of-concept/exploit business impact remediation guidance.

Map findings to OWASP Top 10, SANS Top 25, and CWE, with risk ratings and clear reproduction steps.

Present findings to both engineering teams (code-level detail) and leadership (business risk, executive summary).





Mentor junior pentesters/AppSec engineers on manual code review techniques and exploit development.

Help mature the internal AppSec/pentest methodology — playbooks, custom tooling, and code-review checklists tailored to the tech stacks in use.

5+ years in penetration testing / offensive security, with strong demonstrable experience in application security testing and manual secure code review (not just automated scanning).

- Proven ability to read and understand source code fluently in at least one major backend language (Java, Python, C#, Go, or JavaScript/TypeScript), enough to trace logic, understand data flow, and spot subtle flaws.
- Strong scripting/programming skills (Python, Go, Bash, or similar) for building custom test scripts, automation, and exploit tooling.
- Solid understanding of web/API architecture and common vulnerability classes (OWASP Top 10, SANS Top 25, CWE).
- Hands-on experience with web/API application testing toolchains (e.g., Burp Suite Pro, Postman) and static/dynamic code analysis approaches.
- Strong report writing and communication skills, able to explain code-level vulnerabilities to both developers and non-technical stakeholders.

Prior red team experience — comfort with Active Directory attack paths, lateral movement, privilege escalation, and C2 frameworks (e.g., Experience with mobile application security testing (iOS/Android) including static analysis of app binaries/source.

Knowledge of compliance frameworks (PCI-DSS, ISO 27001, SOC 2) as they relate to application security testing.

Speaking engagements at security/bug bounty conferences (e.g., DEF CON, Black Hat, Nullcon, c0c0n, BSides) or publishing security research/write-ups is a strong plus.

Competitive salary package.

Performance based annual bonus (cash and stocks).

Hybrid working model (3 days office/week).

Group Medical & Life Insurance.

Modern offices with free amenities & fully stocked cafeterias.

Monthly food card & company paid snacks.

Hardship/shift allowance with company provided pickup & drop facility*

Attractive employee referral bonus.

Frequent company sponsored team building events and outings.

Depending upon the shifts.

The advantages package is subject to change at the management's discretion.

📌 Security Technology Engineer (Mumbai)
🏢 Interactive Brokers
📍 Mumbai