Lead Penetration Tester

Overview

WELCOME TO SITA

At SITA, we keep airports moving, airlines flying smoothly, and borders open. Our technology and communication innovations power the success of the global air travel industry.

You'll find us in 95% of international airports, working closely with over 2,500 transportation and government clients. Each partnership brings unique challenges, and we thrive on delivering fresh solutions and cutting-edge tech to keep operations running like clockwork. We don't just move the world forward-we're proud to be recognized as a Great Place to Work® by 79% of our employees and certified in most of our growing locations. Here, we feel empowered, supported, and inspired to grow.

Are you ready to love your job?

The adventure begins right here, with you, at SITA.

PURPOSE

As a Lead Penetration Tester in the Security Assurance & Testing team of the SITA Enterprise Information Security Office, you will find and verify security weaknesses in SITA products and infrastructure before attackers or customers do. You will lead pentests from scoping to closure. You will also direct the technical work of internal and contracted pentesters and make sure their reports meet SITA quality standards. You will help move SITA from manual, point-in-time pentesting to continuous, AI-assisted security testing.

KEY RESPONSIBILITIES

• Run authorized penetration tests on SITA applications, APIs, mobile apps, AI components, cloud environments and infrastructure. Use attacker techniques to confirm how exploitable each weakness is and what it would affect.
• Lead walkthrough and scoping sessions with product and technical teams. Define the test scope and write the pentest plan. Collect and validate prerequisites such as environments, credentials, test data and DAST scan results.
• Give technical direction to internal and contracted pentesters during testing. Unblock testers when they hit technical problems and escalate issues that would put the test or its timeline at risk.
• Review reports for technical accuracy, CVSS scoring and remediation advice before publishing them on the pentest reporting platform. Raise alerts on critical findings as soon as they are confirmed.
• Explain findings and their business impact to development teams, operations, product owners and management. Present results during triage calls.
• Perform or supervise retests. Confirm fixes and produce the summary reports and attestations that SITA shares with customers and regulators.
• Run root-cause analysis on critical and high findings. Feed the lessons learned back to product teams, future test plans and pentest suppliers.
• Evaluate and use AI-assisted pentesting tools. Decide which tasks the tools can run on their own and which need a human tester to check the results.
• Research and develop testing tools, techniques and methodology. Contribute to automating security testing in CI/CD pipelines.
• Advise on secure design through threat modelling and architecture reviews. Share current attacker techniques with the incident response and threat monitoring teams.

Qualifications

EXPERIENCE

• 5-7 years' experience in at least one of the following fields:
  • Network penetration testing
  • Web and mobile application assessments
  • Cloud penetration testing (Azure, AWS,…)
• Mastery of Unix/Linux/Windows operating systems, including bash and PowerShell, shell scripting or automation of simple tasks using Python, Ruby or Perl 
• AI-assisted penetration testing
• Nice to have: developing security test automation as part of a DevOps CI/CD pipeline

KNOWLEDGE & SKILLS

• Excellent ability to think laterally and solve problems in unique ways
• Ability to relate work to the business, understanding the impact to business processes, not just technical impact
• Strong knowledge of attacker tools, techniques and procedures
• Strong understanding of network technologies such as TCP/IP, routing, switching, NAT, Wireless/WiFi, etc.
• Strong ability to research and maintain currency with the latest approaches to penetration testing, including learning new tools and technologies
• Good understanding of security compliance frameworks (e.g. ISO/IEC 27001, PCI DSS, etc.)
• Good understanding of common business applications (e.g. content management systems, application servers, databases, etc.) and how to leverage them in an assessment
• Good understanding of web technologies and how they are commonly subverted (e.g. OWASP Top 10)
• At least a basic understanding of development frameworks (.NET, Java,…)
• Good understanding of AI-assisted penetration testing capabilities: what level of human supervision is necessary vs. what can be fully automated
• Ability to remain calm and methodical under pressure

PROFESSION COMPETENCIES

• Adversarial Thinking
• Cloud Security Assessment
• Exploitation Techniques
• Vulnerability Analysis
• Security pen-testing tool mastery, including AI-assisted
• Threat Modeling
• Network & Active Directory Security Testing
• Application Security Testing
• Privilege Escalation
• Post-Exploitation Techniques
• Red Team Operations
• Security Standards & Compliance
• Incident Simulation & Reporting
• Scripting & Automation
• Risk-Based Assessment
• Security Advisory
• Research & Innovation
• Technical Writing & Documentation

CORE COMPETENCIES

• Collaboration & Teamwork
• Ethics & Professional Integrity
• Analytical & Critical Thinking
• Communication
• Creativity & Innovation
• Resilience & Adaptability
• Results-Oriented Execution
• Stakeholder Influence

EDUCATION & QUALIFICATIONS

• Masters degree in a technical discipline such as Information Security, Computer Science, Engineering, Telecommunications, Mathematics, Physics, or enough work experience to demonstrate proficiency at this level
• Penetration Testing certification (e.g. OSCP, GPEN, CRTO) is considered a strong advantage
• Professional security certification (e.g. CISSP, CISA) is a plus

WHAT WE OFFER

We're all about diversity. We operate in 200 countries and speak 60 different languages and cultures. We're really proud of our inclusive environment. Our offices are comfortable and fun places to work, and we make sure you get to work from home too. Find out what it's like to join our team and take a step closer to your best life ever.

🏡 Flex Week: Work from home up to 2 days/week (depending on your team's needs)

⏰ Flex Day: Make your workday suit your life and plans.

🌎 Flex-Location: Take up to 30 days a year to work from any location in the world.

🌿 Employee Wellbeing: We have got you covered with our Employee Assistance Program (EAP), for you and your dependents 24/7, 365 days/year. We also offer Champion Health - a personalized platform that supports a range of wellbeing needs.

🚀 Professional Development: At SITA, we believe growth fuels innovation. Our learning ecosystem offers access to world-class platforms and programs designed to help you thrive. From LinkedIn Learning, Microsoft's Enterprise Skills Initiative, and Airport Council International -available to all employees-to specialized solutions like Pluralsight for technology upskilling, Harvard Business Publishing for people leadership, Stanford for strategic development and many others, we align learning opportunities with your Development Plan and our business priorities. Your development journey is supported every step of the way.

🙌 Competitive Benefits: Competitive benefits that make sense with both your local market and employment status.

SITA is an Equal Opportunity Employer. We value a diverse workforce. In support of our Employment Equity Program, we encourage women, aboriginal people, members of visible minorities, and/or persons with disabilities to apply and self-identify in the application process.

Salary / Compensation Note

Hidden (-999)