Mid/Senior Penetration Tester

As KKB, we have been the symbol of sustainable trust in financial life for more than 25 years. With the support of our competent human resources and innovative vision in the field of financial technologies, we develop products and services that are recognized as reference points. We are proud of our dynamic and experienced human resources, which have contributed to our successes for a quarter of a century, and we are looking forward to welcoming new colleagues who will strengthen our synergy.

Would you like to be the newest member / a member of this qualified team that develops its business goals on a global scale in order to be an exemplary credit bureau to the world?

What we offer

-We offer alternative working hours (08.00-17.00/09.00-18.00) that respond to today's needs and provide flexibility in managing your time,

-We care about you. For this reason, we are happy to provide you with a comfortable workspace as well as opportunities where you can improve yourself by acquiring new knowledge,

-We contribute to your career journey by providing unlimited training rights on platforms such as LinkedIn Learning, Pluralsight, covering the purchase of technical certificates and supporting your education in programs such as master's and doctoral programs,

-We know that learning and education continue for a lifetime and we bring together technical, professional and personal development training programs and development opportunities that we think can support you on your career path,

-With our social clubs, we support you to discover new hobbies and create a synergy with your teammates in a social environment,

-As an organization, we attach importance to employee volunteerism. All our employees can participate in social responsibility projects with non-governmental organizations under the umbrella of the KKB Volunteers Platform and we make a big difference with small acts of kindness,

-We care about your health; we offer you and your loved ones (spouse/children) a comprehensive health insurance package and title-independent life insurance coverage,

-We create a Corporate Contribution Private Pension plan for your future dreams,

-Considering their past seniority, we base our annual leave policy on their total seniority,

-Birthday leave and more awaits you!

For more information about us, please visit the link:

https://www.kkb.com.tr/hakkimizda

Role Overview

We are looking for a skilled and self-driven Penetration Tester to join our offensive security team. In this role, you will focus on internal infrastructure penetration testing, with a strong emphasis on Active Directory environments and enterprise network security.

You will work as part of a team that continuously assesses and improves our organization's security posture through structured offensive security engagements.

Key Responsibilities

- Perform internal infrastructure penetration tests with a focus on Active Directory environments (attack path mapping, privilege escalation, lateral movement, domain dominance),

- Conduct network penetration tests including segmentation reviews, protocol abuse, and post-exploitation,

- Develop automated tooling and scripts to streamline recurring assessment tasks, extend existing tools, and build repeatable solutions,

- Contribute to vulnerability management processes — validation, prioritization, and tracking,

- Assess and test security controls across the organization (endpoints, network, data, identity),

- Support compliance-driven assessments and security audits against industry frameworks,

- Write clear, actionable reports with findings ranked by business risk, including remediation guidance,

- Collaborate with defensive teams (Blue Team / SOC) to validate detection and response capabilities,

- Research and stay current with emerging attack techniques, tools, and threat landscape.

Required Qualifications

- 3+ years of hands-on experience in penetration testing or red teaming,

- Deep understanding of Active Directory security — Kerberos, LDAP, GPOs, trust relationships, and common attack techniques (Kerberoasting, AS-REP Roasting, DCSync, ACL abuse, etc.),

- Strong grasp of network protocols (TCP/IP, DNS, HTTP/S, SMB, LDAP, RDP, WinRM, etc.) and their abuse vectors,

- Experience with industry-standard tools: BloodHound, Nmap, CrackMapExec/NetExec, Impacket, Cobalt Strike / Sliver / similar C2s,

- Solid understanding of software development principles — ability to read, write, and debug code,

- Proficiency in at least one scripting/programming language (Python, PowerShell, C#, Go, or similar),

- Strong analytical mindset — ability to identify the real problem behind symptoms and design practical solutions,

- Relevant certifications such as OSCP, CRTO, CRTP, or equivalent demonstrated skill level,

- Excellent written and verbal communication skills in English.

Nice to Have

- Experience building security automations and tooling (e.g., integrating with APIs, CI/CD pipelines, scheduling frameworks),

- Web application penetration test skills.

What We Value

We value problem-solving instinct over tool memorization. The ideal candidate doesn't just follow checklists — they understand why something works, can build automations to scale their impact, and has the curiosity to dig deeper when something feels off. If you enjoy creating tools as much as breaking into systems, you'll fit right in.

6698 sayılı Kişisel Verilerin Korunması Kanunu kapsamında kişisel verilerinizin işlenmesinden doğan haklarınıza ve bu konudaki detaylı bilgiye https://www.kkb.com.tr/kkb-calisan-adayi-kvkk-metni adresinde yer alan aydınlatma metnimizden ulaşabilirsiniz.