Ethical hacker

ASML; Veldhoven; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

ASML is seeking an experienced Ethical Hacker to perform authorized penetration testing across applications, infrastructure, and cloud environments. You will lead scoping, produce actionable reports, and present risk remediation options to both technical and non-technical stakeholders in a hybrid setting in the Netherlands.

The role requires 3+ years of offensive security experience, familiarity with web apps, APIs, VDIs, AI-related testing, and relevant certifications.

Qualifications

• 3+ years of experience in penetration testing or offensive security.
• Experience testing web applications, APIs, and cloud environments.
• Certifications in offensive security are a plus; OSCP/GPEN/OSWE/GWAPT or equivalent preferred.

Responsibilities

• Plan and conduct authorized security assessments across diverse technologies and environments.
• Lead intake: clarify objectives, define scope, and agree on engagement rules with stakeholders.
• Produce clear technical reports and executive summaries detailing evidence, impact, and remediation.
• Present findings to technical and non-technical audiences and verify remediation effectiveness.
• Collaborate with developers and security stakeholders to remediate risks while staying objective.
• Improve testing methodologies, tooling, and knowledge assets; create awareness content and training.

Skills

Web security testing

Infrastructure security

Cloud security testing

Programming experience

Communication

Time management

Stakeholder liaison

Education

Cybersecurity degree

Computer science background

Job description

Introduction to the job

ASML relies on complex digital, industrial, and product environments to enable innovation at scale. Within Ethical Hacking Services, we perform independent, authorized security assessments to help protect ASML's products, services, intellectual property, operations and data.

As an Ethical hacker, you will perform penetration tests and security assessments across applications, infrastructure, and cloud environments. We value the diverse expertise within the team, and if you have a solid background in areas such as product security, OT/ICS, adversary simulation, AI, or emerging technologies, you will have the opportunity to apply those skills on specialized engagements.

• Location: Veldhoven, Netherlands
• Team: Legal, Compliance, Risk and Assurance
• Work experience: 0-1 year; 2-3 years; 4-9 years
• Educational background: Computer Science; Data Science; Other technical backgrounds
• Workplace type: Hybrid
• Fulltime/parttime: Full time

Role and responsibilities

In this role, you will:

• Plan and conduct authorized security assessments across a diverse range of technologies, systems, and environments
• Lead intake: clarify objectives, identify dependencies, define scope, select an appropriate test approach, and agree with rules of engagement with relevant stakeholders
• Produce clear technical reports and executive-ready summaries that explain evidence, impact, root cause and practical remediation options
• Present findings to technical and non-technical stakeholders, align corrective actions, and perform re‑assessments to verify remediation effectiveness
• Collaborate with developers, engineers, and security stakeholders to identify, prioritize, and remediate security risks, while maintaining the independence and objectivity of security assessments
• Improve testing methodologies, automation, knowledge assets, tooling and service processes; share lessons learned and contribute to team capability development. Share security knowledge and real-world insights by creating and delivering awareness content, training, and workshops that promote a strong security culture across the organization.

Education and experience

We are looking for experienced pentesters who can work independently, make sound technical judgments, and communicate risks clearly.

• 3+ years of experience in penetration testing, ethical hacking, or a closely related offensive security role
• Familiarity with testing web applications, thick clients, VDIs, APIs, web services, AI, and performing source code reviews in multiple programming languages
• Threat modeling and architecture reviews with software solutions is a plus
• Experience testing GenAI applications and LLM models
• A degree in cybersecurity, computer science, engineering or a related technical discipline is preferred; equivalent professional experience is also valued
• Preferred certifications: Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN) or comparable hands‑on penetration testing certification; Offensive Security Web Expert (OSWE), GIAC Web Application Penetration Tester (GWAPT) or comparable application security certification; Certified Red Team Operator (CRTO), Certified Red Team Professional (CRTP) or comparable red teaming / adversary emulation certification; relevant SANS, cloud, mobile, OT/ICS or product security training and certifications

Skills

• Depth in one or more core domains: web, infrastructure, cloud security testing
• Programming experience in one or more languages
• Ability to validate findings manually, reason over attack paths, and avoid overreliance on automated tooling
• Good time management skills; the ability to commit and adhere to time-sensitive deliverables
• Clear communication with both technical and non-technical stakeholders
• Ability to conduct scoping and closure meeting calls, be the main point of contact, lead report generation activities, and be the main interface with stakeholders on security assessments
• Nice to have: AI/LLM security testing, OT/ICS security, product security, reverse engineering, hardware security, source-code review, exploit development, or adversary emulation

Other information

• Some work may require onsite presence, cross-time-zone coordination, or limited travel.
• This is a pipeline vacancy, and we welcome applications from candidates across different seniority levels, including junior, mid-level, and senior profiles.
• The position is open to candidates residing in the Netherlands or the European Union, with eligibility to work in the relevant location.