Offensive Security Engineer (Application and Network Penetration Testing) for NATO with security clearance

WLG; Den Haag; On-site; EUR 70,000 - 110,000; Full time

Job summary

WLG in The Hague is seeking an experienced penetration tester to join our testing cell, leading or joining red and blue teams during multinational exercises and testing the systems the organisation relies on. The role is on-site in The Hague, Netherlands, with around ten days of travel foreseen.

You will perform web, infrastructure and application-level testing, conduct security design reviews, provide consultancy to projects, and brief executives on findings and remediation.

Qualifications

• More than three years of hands-on depth across web application and IT infrastructure penetration testing, and network security architecture design.
• Assessing vulnerabilities in operating systems, software, protocols and networks, and evaluating security products and technologies.
• System and network administration on both UNIX and Windows.
• Recognised testing methodologies and the tooling that goes with them.
• Scripting in at least one of Perl, Python, Ruby or shell.
• Real technical knowledge of authentication and security protocols, cryptography, application security, malware infection techniques and the protections against them.
• The ability to evaluate risk and write a mitigation plan, not just a finding.
• Clear, structured technical writing — executive summary, technical detail and remediation, for audiences that read very differently

Responsibilities

• Leading, or forming part of, the red and blue teams during large multinational exercises
• Web, infrastructure and application-level penetration testing
• Security design reviews, checking compliance against organisational policy and directives
• Security consultancy and advice to projects, plans and other parts of the organisation
• Working with configuration control boards, accreditation boards and the national accreditation authorities that sign systems off
• Briefing at both technical and executive level — including the most senior officers — on findings and remediation

Skills

Penetration testing

Web security testing

Infrastructure security

Security design reviews

Scripting (Perl/Python/Ruby/shell)

Technical writing

Risk assessment & mitigation

Executive briefing

Tools

Burp Suite

Metasploit

Nessus

Wireshark

Job description

You would spend the year finding what an adversary would find first. A multinational defence organisation is looking for a penetration tester to work inside its testing cell: leading or joining red and blue teams during military exercises, and testing the systems the rest of the year. On-site in The Hague, Netherlands, with around ten days of travel foreseen.

What You Will Be Doing

• Leading, or forming part of, the red and blue teams during large multinational exercises
• Web, infrastructure and application-level penetration testing
• Security design reviews, checking compliance against organisational policy and directives
• Security consultancy and advice to projects, plans and other parts of the organisation
• Working with configuration control boards, accreditation boards and the national accreditation authorities that sign systems off
• Briefing at both technical and executive level — including the most senior officers — on findings and remediation

What you will need

• More than three years of hands-on depth across web application and IT infrastructure penetration testing, and network security architecture design
• Assessing vulnerabilities in operating systems, software, protocols and networks, and evaluating security products and technologies
• System and network administration on both UNIX and Windows
• Recognised testing methodologies and the tooling that goes with them
• Scripting in at least one of Perl, Python, Ruby or shell
• Real technical knowledge of authentication and security protocols, cryptography, application security, malware infection techniques and the protections against them
• The ability to evaluate risk and write a mitigation plan, not just a finding
• Clear, structured technical writing — executive summary, technical detail and remediation, for audiences that read very differently

Why this one is worth a look

The exercises are real, the scope is broad, and your reports get read at the top of the organisation. Few penetration testing roles combine that reach with this much technical freedom.