Lead Software Engineer

Must have

• 6+ years application penetration testing or security test engineering, with specific experience testing
  
  

authentication and session-management controls.

• OSCP, GWAPT, CREST or equivalent, or a demonstrable track record in lieu.
• Test leadership on regulated customer-facing systems, including ownership of traceability and evidence
  
  

artefacts.

• Comfortable authoring abuse cases, not only functional scripts.
• Client-facing during UAT and security workshops.
• 4+ years hands-on functional, regression, performance and accessibility execution.
• Test automation capability sufficient to automate a multi-state journey within a single cycle.
• Performance testing tooling and the ability to calibrate to a supplied volume profile.
  
  

Security testing

Burp Suite Professional — Repeater, Intruder, Sequencer, Comparer, macros and session handling rules

OWASP ZAP

ffuf or wfuzz for enumeration and fuzzing

Manual request crafting and interception

Concurrency and race-condition testing on issuance and verification

Timing measurement across many samples to prove response uniformity on identity match and non-match

Log and telemetry inspection to evidence absence of passcode material

Test automation

Playwright or Selenium WebDriver, in C#, Java or TypeScript bindings

REST Assured or RestSharp for API-level cases

xUnit, NUnit, JUnit 5 or TestNG

Page object or equivalent structuring for a multi-state journey

Performance

JMeter, k6 or Gatling

Correlation, parameterisation and think-time modelling

Result analysis against a supplied peak profile