Description
LSEG is seeking a Senior Security Specialist to join the Cyber Security – Security Testing team as a penetration testing subject matter expert (SME). This engagement-focused, technical role plans, scopes and drives penetration tests across a wide range of systems and applications, providing technical oversight, assurance and consulting expertise throughout the engagement lifecycle.
Key Responsibilities:
Security Testing Engagement Oversight
- Oversee penetration testing engagements throughout the lifecycle, ensuring comprehensive coverage and quality.
- Ensure engagements are appropriately scoped; interview application teams and review architecture to agree scope with all stakeholders.
- Define per-engagement prerequisites, assumptions, constraints and dependencies.
- Identify prerequisites and blockers to punctual delivery and drive their resolution.
- Provide technical oversight during the execution phase.
- Interface with and manage third-party vendors who deliver security testing engagements.
Technical Governance & Quality Assurance
- Act as the technical authority and SME for penetration testing engagements.
- Review testing methodologies, coverage and attack paths to ensure effectiveness.
- Review penetration testing reports produced by team members and third parties - eliminate false positives and ensure accurate, appropriately rated findings.
- Peer review retest evidence and validate remediation outcomes.
Vulnerability Reporting & Remediation
- Conduct overview/debrief sessions before and after engagements to ensure clarity and understanding.
- Ensure reporting of security testing activities is tailored to the intended audience.
- Engage with technical and business stakeholders to convey testing outcomes clearly.
- Support technical teams to understand findings and cyber security concepts.
- Advise remediation efforts, compensating controls and risk mitigation solutions; support risk acceptance/exception processes where required.
Practice Improvement & Evangelism
- Drive initiatives to improve internal penetration testing practices with new ideas or processes and contribute to the development of internal security testing tools.
- Compile and maintain runbooks, checklists, methodologies and frameworks to improve coverage and scale.
- Advocate the benefits of the various cyber security service offerings and refer stakeholders to the appropriate internal teams where gaps are identified.
Reporting & Metrics
- Contribute to relevant KPIs, KRIs and other metrics, and to the team's operating model improvement.
- Stay current with security trends, testing tools, exploit techniques and industry news.
Competencies:
- Technical: Apply deep penetration testing knowledge to scope, review, challenge and assure testing approaches, methodologies, coverage and findings across applications, infrastructure and cloud.
- Risk Management: Accurately risk-rate findings, validate remediation, and advise on compensating controls and risk acceptance in line with organisational standards.
- Leadership: Direct engagement delivery and quality across internal and vendor-delivered testing; coach testers and share subject matter expertise.
- Analytical: Apply structured thinking and evidence to assess testing outcomes, challenge assumptions and drive continuous improvement in coverage and practice.
- Communication: Translate technical findings into clear, audience-appropriate reporting for technical teams and business stakeholders, and align teams around engagement outcomes.
Required Skills & Experience:
- Strong working knowledge of penetration testing across Web Applications, APIs, Thick Client and infrastructure.
- Solid grasp of application security, network protocols, operating systems and cloud/containerised environments (AWS, Azure, GCP, Docker, Kubernetes).
- Familiarity with industry tooling (e.g. Burp Suite) and testing standards (OWASP, PTES).
- Proven record of driving and overseeing security engagements.
- Ability to review penetration testing reports, eliminate false positives, and ensure findings are accurate and appropriately prioritised.