Hybrid Senior Product Security Engineer, Pen Tester

at Blackhawk Network

• Job title: Senior Product Security Engineer, Pen Tester
• Job type: Full Time
• Experience level: Senior
• Salary: $125,100 - $168,900 per year
• Degree requirement: Bachelor's Degree
• Tech skills: JavaScript, Python, Selenium, Go
• Location requirements: Hybrid, Coppell, United States

About the role

• Senior Product Security Engineer protecting fintech platform from fraud, carding attacks, and security threats. Leading penetration testing and enhancing cybersecurity defenses in a fast-paced environment.

Responsibilities

• Lead penetration testing engagements focused on payment abuse, transaction manipulation, and business logic exploitation
• Design and execute automated attack simulations to test our defenses against carding and BIN attacks, credential stuffing and account takeovers, checkout and payment flow abuse, API-level enumeration and fraud
• Build custom tooling and frameworks to mimic the behavior of real-world fraudsters and cybercriminals
• Partner with fraud engineering, product security, and risk teams to identify weak points in our controls, detection systems, and architecture
• Conduct threat modeling and red teaming exercises related to payments, authentication, and user account abuse
• Document findings in technical reports with clear risk impact, exploitability, and remediation guidance
• Mentor junior testers and contribute to a culture of security innovation and continuous improvement

Requirements

• 7+ years of experience in offensive security, penetration testing, or red teaming
• Strong background in payment systems, financial fraud tactics, and transaction-level attack surfaces
• Fluency in scripting and automation (e.g., Python, JavaScript, Go, Bash)
• Familiarity with tools like Burp Suite Pro, Selenium, Scapy, ffuf, SQLMap, Metasploit, and bot automation frameworks
• In-depth knowledge of fintech technologies (e.g., tokenized payments, card vaulting, 3DS, ACH, real-time payment APIs)
• Solid grasp of common attacker techniques: carding, fake identity generation, bypassing rate limits, evading fraud filters, and abusing web/app logic
• Strong communication skills for explaining findings to both technical and non-technical audiences
• Certifications: OSCP, OSEP, GWAPT, GPEN, GCPN, GXPN, GX-PT, CPSA/CRSA by CREST, CHECK, or TIGER
• Prior experience in a fintech, digital banking, or payment gateway environment
• Familiarity with OWASP Automated Threats, PCI DSS, MITRE ATT&CK for Financial Services, or fraud detection systems
• Experience building or testing real-time risk scoring engines and fraud defense pipelines

Benefits

• 401k with employer match
• Medical, dental, vision insurance
• 12 paid holidays in the year 2025
• 1 hour of sick pay accrual for every 30 hours worked
• Parental leave
• Life insurance
• Disability insurance
• Accident and illness insurance
• Health and dependent care flexible spending accounts
• Wellness benefits
• Flexible time off for all full-time employees