Senior Security Consultant-- Kubernetes/Istio Pen Testing in Banking Domain

Urgent requirement for Senior Security Consultant-- Kubernetes/Istio Pen Testing in Banking Domain is required for our banking clients in Oman

Hands-on Kubernetes cluster pen testing, RBAC audits, and container escape validation is MUST

Direct experience testing Istio mTLS, Authorization Policies, and Ingress/Egress gateways is MUST

Conduct grey-box web/mobile assessments is MUST

Banking Domain is MUST

Position Overview

The Senior Security Consultant will lead hands-on penetration testing, service mesh security assessments, and infrastructure reviews for new projects and Change Requests (CRs) across pre-production and production environments. The ideal candidate brings extensive BFSI domain expertise, deep hands-on expertise in offensive security, Kubernetes/Istio security, and vendor management capabilities.

Key Details

·        Experience Required: 5–7+ Years (Offensive Security / VAPT Focus)

·        Domain Focus: BFSI / Payment Systems / Digital Banking Platforms

·        Certifications (Preferred): OSCP, OSEP, OSWE, CKS, CREST, GPEN, GWAPT, CISSP

Core Responsibilities

·        Offensive Security & Pen Testing: Conduct grey-box web/mobile assessments, API gateway security reviews, microservices penetration testing, and internal/external network penetration testing.

·        Cloud-Native & Container Security: Perform deep-dive security assessments of Kubernetes clusters (control plane, worker nodes, RBAC, container escape risks) and Istio Service Mesh (mTLS, authorization policies, traffic management).

·        Configuration Reviews: Evaluate OS, DB, firewalls, network devices, and ingress controllers against CIS benchmarks and hardening standards.

·        Vendor & Stakeholder Engagement: Manage internal/external penetration testing vendors, define assessment scopes, validate findings, track remediation, and conduct risk workshops with technical and business stakeholders.

MANDATORY (100% Fit Threshold)                              

·        BFSI Domain: 5–7+ yrs experience in Banking / Payment Systems (Core/Digital Banking, PCI DSS).

·        K8s & Container Security: Hands-on Kubernetes cluster pen testing, RBAC audits, and container escape validation.

·        Istio Service Mesh: Direct experience testing Istio mTLS, Authorization Policies, and Ingress/Egress gateways.

·        App & API Pen Testing: Grey-box Web, Mobile (iOS/Android), and API Gateway / OWASP API Top 10.

·        Infra & Hardening: Internal/External Network Pen Testing + CIS Benchmark reviews (Linux, DBs, Firewalls).

·        Vendor Management: Experience coordinating 3rd-party pen testers, validating reports, and leading risk workshops.