Senior Offensive Security Engineer: Lead Pen Tests & Cloud

PLP Group; Greater London; On-site; GBP 77,000 - 103,000; Full time

Job summary

Klarna is seeking an experienced Offensive Security Engineer to perform penetration testing across internal and public-facing systems. You will triage Bug Bounty submissions, analyze variants, and assess third-party integrations within Klarna's AWS microservice stack.

You will build tooling and provide hands-on guidance to developers and SOC teams. You will bring strong coding insight for Java and Node.js, and you’ll participate in training and workshops to spread offensive security practices

Qualifications

• 5+ years running penetration tests and security assessments on production systems.
• Proficient in reading code and identifying vulnerabilities in Java and Node.js.
• Experience operating in AWS and reviewing microservice architectures for security gaps.
• Ability to write clear, actionable remediation steps tied to concrete fixes.

Responsibilities

• Run white-box and black-box penetration tests against internal systems and public-facing apps.
• Manage, triage, and investigate Bug Bounty submissions and external pentest findings.
• Perform variant analysis to identify related bugs across code and infrastructure.
• Research and assess security of third-party integrations and solutions.
• Build tooling for reconnaissance, automation, and metrics collection.
• Guide developers and SOC investigations with practical security advice.

Skills

Penetration testing

Security assessments

Java

Node.js

AWS

Python scripting

Bug bounty triage

CTF participation

Security certifications

Job description

Klarna is seeking an experienced Offensive Security Engineer to perform penetration testing across internal and public-facing systems. You will triage Bug Bounty submissions, analyze variants, and assess third-party integrations within Klarna's AWS microservice stack.

You will build tooling and provide hands-on guidance to developers and SOC teams. You will bring strong coding insight for Java and Node.js, and you’ll participate in training and workshops to spread offensive security practices