Associate - Security Test Engineer

The bank for a changing world The BNP Paribas Group Find here the essentials on BNP Paribas: governance, strategy, organisation and key figures. Our commitments We are committed to make a sustainable and inclusive contribution to the environmental, societal, technological and economic challenges of our time. News & Mediaroom Our financial results, business activites, solutions and recent sustainable finance initiatives: news, analysis and viewpoints. News Our financial results, business activites, solutions and recent sustainable finance initiatives: news, analysis and viewpoints. Mediaroom Our financial results, business activites, solutions and recent sustainable finance initiatives: news, analysis and viewpoints. Careers Our ambition ? To build a sustainable future. But we can’t do that without you! Want to be part of the change? Choose your profile You are Associate - Security Test Engineer Job Title: Security Test Engineer Department : ITG CDF About Business line/Function: ITG provides testing services for the BNP Paribas Group. The Security testing team is responsible for executing SAST, Penetration Tests (Black or Gray Box) for the Web and Mobile applications pertaining to the group. Position Purpose: The purpose of the position is to help with the Mobile security testing activities mentioned in the direct responsibilities. Responsibilities Direct Responsibilities · To perform Penetration testing (Gray Box and/or Black Box) for Web applications, Mobile, API, and thick client applications. · Hands-on mobile penetration tester with strong knowledge and experience in Android and iOS application security testing (both static and dynamic), responsible for discovering, validating and reporting security issues in mobile applications. · Perform Static analysis (SAST) and Dynamic analysis (DAST) on Android APKs and iOS IPA to identify insecure storage, hardcoded secrets, insecure configurations, runtime hooking, parameter tampering etc · Conduct reverse engineering and protection bypass on mobile applications including decompiling /inspecting binaries, analyzing native libraries (.so/.dylib) and bypassing client-side protections (root / jailbreak detection, SSL pinning, obfuscation, tamper checks etc.) using tools like Frida, objection magisk, cydia/selio/zebra and Xposed. · Strong research knowledge and should be updated with evolving mobile threats and industry standard (OWASP MASVS/MASTG) · To understand the application’s security requirements and identify & document the scope of the test. · Ensure execution of the documented security scenarios for the application under test. · Document and report all findings. · Collaborate with the developers to help them understand the vulnerabilities reported in application. · Escalate issues to the local management and onshore stakeholders in case it affects the testing progress. · Ensure processes for the project is followed for the assessments. · Note: o Mandatory requirement – Mobile, Web & API Penetration Testing o Optional, experience in Source Code Assessment (SCA)/SAST. Contributing Responsibilities Technical & Behavioral Competencies · Clear understanding of OWASP Top 10 - application security risks · Tools/OS: Burp Suite, OWASP ZAP, Kali Linux, mobsf, jadx, dex2jar, adb, xcode, Frida, objection, apktool, putil, otool. · Manual Security Testing & Analysis, Security Test Designing · Excellent Interpersonal and presentation skills · Strong in verbal and written communication · Good analytical skills · Strong Time Management · Must be flexible, independent, self-motivated. · Team player Specific Qualifications: CSSLP/CEH or equivalent certification preferred. Skills Referential ( Required knowledge, skills and abilities) Technical Skills: · Mobile, Web, think Clients & API Penetration Testing with hands on experience Burp Suite, OWASP ZAP, Kali Linux tools. · Manual Security Testing & Analysis, Security Test Designing (CSSLP/CEH or equivalent certification preferred) · SAST/DAST & Reverse Engineering · WASP Top 10 & MASVS/MASTG Standards · Awareness of Cyber Security Risks & Data protection procedures. Behavioral Skills: · Ability to collaborate / Teamwork · Attention to detail / rigor · Communication skills - oral & written Education Level: Bachelor’s Degree or Equivalent with at least 3-5 years of Experience. Location: Mumbai/Chennai/Bangalore BNP Paribas is the European Union’s leading bank and key player in international banking. It operates in 65 countries and has nearly 185,000 employees, including more than 145,000 in Europe. The Group has key positions in its three main fields of activity: Commercial, Personal Banking & Services for the Group’s commercial & personal banking and several specialized businesses including BNP Paribas Personal Finance and Arval; Investment & Protection Services for savings, investment, and protection solutions; and Corporate & Institutional Banking, focused on corporate and institutional clients. Based on its strong diversified and integrated model, the Group helps all its clients (individuals, community associations, entrepreneurs, SMEs, corporates and institutional clients) to realize their projects through solutions spanning financing, investment, savings and protection insurance. In Europe, BNP Paribas has four domestic markets: Belgium, France, Italy, and Luxembourg. The Group is rolling out its integrated commercial & personal banking model across several Mediterranean countries, Turkey, and Eastern Europe. As a key player in international banking, the Group has leading platforms and business lines in Europe, a strong presence in the Americas as well as a solid and fast-growing business in Asia-Pacific. BNP Paribas has implemented a Corporate Social Responsibility approach in all its activities, enabling it to contribute to the construction of a sustainable future, while ensuring the Group's performance and stability. About BNP Paribas India Solutions: Commitment to Diversity and Inclusion Share this page! Cotation Publications Direct Access Follow us on The bank for a changing world Job Title: Security Test Engineer Department : ITG CDF About Business line/Function: ITG provides testing services for the BNP Paribas Group. The Security testing team is responsible for executing SAST, Penetration Tests (Black or Gray Box) for the Web and Mobile applications pertaining to the group. Position Purpose: The purpose of the position is to help with the Mobile security testing activities mentioned in the direct responsibilities. Responsibilities Direct Responsibilities · To perform Penetration testing (Gray Box and/or Black Box) for Web applications, Mobile, API, and thick client applications. · Hands-on mobile penetration tester with strong knowledge and experience in Android and iOS application security testing (both static and dynamic), responsible for discovering, validating and reporting security issues in mobile applications. · Perform Static analysis (SAST) and Dynamic analysis (DAST) on Android APKs and iOS IPA to identify insecure storage, hardcoded secrets, insecure configurations, runtime hooking, parameter tampering etc · Conduct reverse engineering and protection bypass on mobile applications including decompiling /inspecting binaries, analyzing native libraries (.so/.dylib) and bypassing client-side protections (root / jailbreak detection, SSL pinning, obfuscation, tamper checks etc.) using tools like Frida, objection magisk, cydia/selio/zebra and Xposed. · Strong research knowledge and should be updated with evolving mobile threats and industry standard (OWASP MASVS/MASTG) · To understand the application’s security requirements and identify & document the scope of the test. · Ensure execution of the documented security scenarios for the application under test. · Document and report all findings. · Collaborate with the developers to help them understand the vulnerabilities reported in application. · Escalate issues to the local management and onshore stakeholders in case it affects the testing progress. · Ensure processes for the project is followed for the assessments. · Note: o Mandatory requirement – Mobile, Web & API Penetration Testing o Optional, experience in Source Code Assessment (SCA)/SAST. Contributing Responsibilities Technical & Behavioral Competencies · Clear understanding of OWASP Top 10 - application security risks · Tools/OS: Burp Suite, OWASP ZAP, Kali Linux, mobsf, jadx, dex2jar, adb, xcode, Frida, objection, apktool, putil, otool. · Manual Security Testing & Analysis, Security Test Designing · Excellent Interpersonal and presentation skills · Strong in verbal and written communication · Good analytical skills · Strong Time Management · Must be flexible, independent, self-motivated. · Team player Specific Qualifications: CSSLP/CEH or equivalent certification preferred. Skills Referential ( Required knowledge, skills and abilities) Technical Skills: · Mobile, Web, think Clients & API Penetration Testing with hands on experience Burp Suite, OWASP ZAP, Kali Linux tools. · Manual Security Testing & Analysis, Security Test Designing (CSSLP/CEH or equivalent certification preferred) · SAST/DAST & Reverse Engineering · WASP Top 10 & MASVS/MASTG Standards · Awareness of Cyber Security Risks & Data protection procedures. Behavioral Skills: · Ability to collaborate / Teamwork · Attention to detail / rigor · Communication skills - oral & written Education Level: Bachelor’s Degree or Equivalent with at least 3-5 years of Experience. Location: Mumbai/Chennai/Bangalore BNP Paribas is the European Union’s leading bank and key player in international banking. It operates in 65 countries and has nearly 185,000 employees, including more than 145,000 in Europe. The Group has key positions in its three main fields of activity: Commercial, Personal Banking & Services for the Group’s commercial & personal banking and several specialized businesses including BNP Paribas Personal Finance and Arval; Investment & Protection Services for savings, investment, and protection solutions; and Corporate & Institutional Banking, focused on corporate and institutional clients. Based on its strong diversified and integrated model, the Group helps all its clients (individuals, community associations, entrepreneurs, SMEs, corporates and institutional clients) to realize their projects through solutions spanning financing, investment, savings and protection insurance. In Europe, BNP Paribas has four domestic markets: Belgium, France, Italy, and Luxembourg. The Group is rolling out its integrated commercial & personal banking model across several Mediterranean countries, Turkey, and Eastern Europe. As a key player in international banking, the Group has leading platforms and business lines in Europe, a strong presence in the Americas as well as a solid and fast-growing business in Asia-Pacific. BNP Paribas has implemented a Corporate Social Responsibility approach in all its activities, enabling it to contribute to the construction of a sustainable future, while ensuring the Group's performance and stability. About BNP Paribas India Solutions: Commitment to Diversity and Inclusion