Product Security Penetration Tester (Industrial & Cloud)

FOSS; Hillerød Kommune; On-site; DKK 900,000 - 1,300,000; Full time

Job summary

FOSS in Denmark is seeking a Penetration Tester & Product Security Specialist to build a vulnerability management capability from the ground up. You’ll work with R&D to embed security into products, reporting to the Head of Information Security.

This full-time, onsite role requires hands-on testing across embedded, instrument, and cloud platforms, familiarity with IEC 62443, SBOM, CVSS, and 24/72-hour response cycles, and the ability to persuade engineers to act on findings.

Qualifications

• Hands-on penetration testing experience against real systems (embedded/industrial targets).
• Strong software engineering skills in C, C++, C#, Python; ability to read production code and discuss fixes with developers.
• Knowledge of IEC 62443 4-1 and 4-2 and applicability to product manufacturers.
• Practical vulnerability management: SBOM/Software composition analysis, CVE, CVSS, VEX; ability to judge exploitability.

Responsibilities

• Plan and perform hands-on penetration testing across Windows, Linux, embedded targets, web interfaces, APIs, and Azure.
• Own the penetration testing program: scope, frequency, in-house vs external testing decisions.
• Build and run vulnerability management and triage findings based on product context.
• Operate the vulnerability handling process per Cyber Resilience Act: 24-hour warnings, 72-hour notifications.
• Support R&D on product risk assessments and STRIDE threat modelling to improve credibility and adoption.
• Advise on secure design and development with IEC 62443-4-1/4-2 in industrial environments.
• Contribute security requirements, testing evidence, and documentation for conformity to standards.

Skills

Penetration testing

C/C++

C#

Python

Threat modelling

IEC 62443

SBOM

Vulnerability management

English (professional)

Job description

FOSS in Denmark is seeking a Penetration Tester & Product Security Specialist to build a vulnerability management capability from the ground up. You’ll work with R&D to embed security into products, reporting to the Head of Information Security.

This full-time, onsite role requires hands-on testing across embedded, instrument, and cloud platforms, familiarity with IEC 62443, SBOM, CVSS, and 24/72-hour response cycles, and the ability to persuade engineers to act on findings.