# Senior Security Specialist

**Company**: London Stock Exchange Group (LSEG)
**Location**: Bucharest
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Finance

**Apply**: https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/IND-BLR-Divyasree-Technopolis/Senior-Security-Specialist_R0122006?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_668d8049-df5

## Description

LSEG is seeking a Senior Security Specialist to join the Cyber Security – Security Testing team as a penetration testing subject matter expert (SME). This engagement-focused, technical role plans, scopes and drives penetration tests across a wide range of systems and applications, providing technical oversight, assurance and consulting expertise throughout the engagement lifecycle.

**Key Responsibilities:**

### Security Testing Engagement Oversight

- Oversee penetration testing engagements throughout the lifecycle, ensuring comprehensive coverage and quality.

- Ensure engagements are appropriately scoped; interview application teams and review architecture to agree scope with all stakeholders.

- Define per-engagement prerequisites, assumptions, constraints and dependencies.

- Identify prerequisites and blockers to punctual delivery and drive their resolution.

- Provide technical oversight during the execution phase.

- Interface with and manage third-party vendors who deliver security testing engagements.

### Technical Governance & Quality Assurance

- Act as the technical authority and SME for penetration testing engagements.

- Review testing methodologies, coverage and attack paths to ensure effectiveness.

- Review penetration testing reports produced by team members and third parties - eliminate false positives and ensure accurate, appropriately rated findings.

- Peer review retest evidence and validate remediation outcomes.

### Vulnerability Reporting & Remediation

- Conduct overview/debrief sessions before and after engagements to ensure clarity and understanding.

- Ensure reporting of security testing activities is tailored to the intended audience.

- Engage with technical and business stakeholders to convey testing outcomes clearly.

- Support technical teams to understand findings and cyber security concepts.

- Advise remediation efforts, compensating controls and risk mitigation solutions; support risk acceptance/exception processes where required.

### Practice Improvement & Evangelism

- Drive initiatives to improve internal penetration testing practices with new ideas or processes and contribute to the development of internal security testing tools.

- Compile and maintain runbooks, checklists, methodologies and frameworks to improve coverage and scale.

- Advocate the benefits of the various cyber security service offerings and refer stakeholders to the appropriate internal teams where gaps are identified.

### Reporting & Metrics

- Contribute to relevant KPIs, KRIs and other metrics, and to the team's operating model improvement.

- Stay current with security trends, testing tools, exploit techniques and industry news.

**Competencies:**

- **Technical:** Apply deep penetration testing knowledge to scope, review, challenge and assure testing approaches, methodologies, coverage and findings across applications, infrastructure and cloud.

- **Risk Management:** Accurately risk-rate findings, validate remediation, and advise on compensating controls and risk acceptance in line with organisational standards.

- **Leadership:** Direct engagement delivery and quality across internal and vendor-delivered testing; coach testers and share subject matter expertise.

- **Analytical:** Apply structured thinking and evidence to assess testing outcomes, challenge assumptions and drive continuous improvement in coverage and practice.

- **Communication:** Translate technical findings into clear, audience-appropriate reporting for technical teams and business stakeholders, and align teams around engagement outcomes.

**Required Skills & Experience:**

- Strong working knowledge of penetration testing across Web Applications, APIs, Thick Client and infrastructure.

- Solid grasp of application security, network protocols, operating systems and cloud/containerised environments (AWS, Azure, GCP, Docker, Kubernetes).

- Familiarity with industry tooling (e.g. Burp Suite) and testing standards (OWASP, PTES).

- Proven record of driving and overseeing security engagements.

- Ability to review penetration testing reports, eliminate false positives, and ensure findings are accurate and appropriately prioritised.

## Skills

### Required
- penetration testing
- application security
- network protocols
- operating systems
- cloud security
- Burp Suite
- OWASP
- PTES

### Nice to have
- Threat Modelling
- OSCP
- GPEN
- GWAPT
- CREST

---

Source: [Apply at lseg.wd3.myworkdayjobs.com](https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/IND-BLR-Divyasree-Technopolis/Senior-Security-Specialist_R0122006?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)