Offensive security engineer

Joppy; España; On-site; EUR 60,000 - 90,000; Full time

Benefits offered by this job

Private health insurance

Gym access

Wellness programs

Language classes

Office breakfasts

Organic fruit

Discounts on meals

Free coffee and tea

Pet-friendly environment

Job summary

Joppy ищет специалиста по Offensive Security для проведения проактивного тестирования приложений, API и инфраструктуры. Работайте с командами разработки над устранением уязвимостей и внедрением безопасных практик на этапе CI/CD. Требуется 4+ года опыта в области безопасности, владение английским и опыт тестирования веб-приложений.

Работа в Испании, офисная или гибридная среда, ожидаются эксперты по безопасности, способные разрабатывать инструменты и методики защиты, включая работу с AI и LLM.

Qualifications

• 4+ лет опыта в Application Security / Offensive Security / Penetration Testing
• Web Application Penetration Testing обязателен
• Опыт работы с Python или Bash для тестирования и автоматизации
• Свободное владение английским языком

Responsibilities

• Проведение проактивного тестирования на проникновение в приложения, API, инфраструктуру и функции с использованием AI
• Воспроизведение и валидация отчетов об уязвимостях от сторонних источников
• Сотрудничество с командами разработки для исправления уязвимостей и повышения безопасного кодирования
• Улучшение процессов валидации, сортировки и устранения уязвимостей из bug bounty и внутреннего тестирования
• Разработка и совершенствование безопасных автоматизаций и CI/CD контролей

Education

Engineering or Computer Science degree

Job description

Описание: One of the companies we work with at Joppy, a TOP Startup, is looking for an Offensive Security Engineer to join the team.

Задачи:

• Perform proactive penetration testing across company’s applications, APIs, infrastructure, and AI-powered features.
• Reproduce and validate vulnerability reports submitted by third parties, like our bug bounty program.
• Collaborate with development teams to remediate security findings and enhance secure coding practices.
• Improve how we validate, triage, and remediate vulnerabilities from bug bounty reports, internal testing, automated controls, and external research.
• Hunt for recurring or legacy vulnerability patterns based on root cause analysis, previous incidents, and security findings.
• Build and improve security automations, agents, skills, and CI/CD controls that help engineering teams catch and fix issues earlier.
• Help secure company’s use of AI across product and internal workflows, including LLMs, agents, data access, tools, permissions, and abuse scenarios.
• Contribute to the development of our security tools, automations, and infrastructure.
• Stay up-to-date with the latest security research, threats, attack techniques, and emerging AI security risks.

Требования:

• You have 4+ years of professional experience in Application Security, Offensive Security, or Penetration Testing.
• Web Application Penetration Testing experience is mandatory.
• You hold a degree in Engineering or Computer Science and have strong knowledge of web applications, databases, network protocols, and operating systems.
• You possess strong knowledge in cybersecurity fundamentals, CVSS, testing methodologies, and tooling.
• You are fluent with scripting or programming languages used in security testing and automation, such as Python or Bash.
• You are technical, curious, and comfortable moving across different security problems instead of specializing in only one area.
• You like to attack systems, but you also enjoy building tools, automations, guardrails, and practical solutions that make security scale.
• You do not need to be an expert in every technology, but you should be able to reason critically, learn fast, use AI effectively, and design pragmatic solutions.
• You have curiosity and willingness to learn about AI security topics such as LLM testing, prompt injection, agentic workflows, data exposure, tool permissions, RAG security, and secure AI adoption.
• Fluency in English is required.
• Будет плюсом: Certifications like BSCP or eWPTX are highly regarded but not mandatory; Experience with Ruby / Ruby on Rails applications is highly regarded, but not mandatory

Условия:

• Collaborative, multicultural, and high-growth work environment
• Private health insurance
• Access to gym, pools, and wellness programs
• Savings on expenses
• Language classes
• Office breakfasts and organic fruit
• Exclusive discounts on meals
• Free coffee and tea
• Pet-friendly environment