Senior Ethical Hacker

bol.com; Netherlands; On-site; EUR 85,000 - 110,000; Full time

Job summary

bol.com is seeking a Senior Ethical Hacker to advance platform safety through offensive security, pen-testing, and threat modeling across our cloud and on-premises environments.

You will review designs, run vulnerability assessments, and lead security projects while collaborating with a skilled blue team to keep our retail ecosystem secure.

Qualifications

• Accomplished ethical hacker with web apps and cloud-native exposure.
• Capable of quick assessments and in-depth pen tests.
• Experience in large engineering environments using open-source tools.
• Responds to security alerts and collaborates with engineers.
• Strong Linux/Tomcat/Java/Spring/Kubernetes/GCP skills.

Responsibilities

• Penetration tests on request and proactively.
• Prioritize high‑risk threats.
• Review technical designs and ideas.
• Conduct vulnerability assessments of apps, systems, and networks.
• Threat-model to aid product teams in risk assessment.
• Support security incident management and major projects.

Skills

Ethical hacking

Penetration testing

Threat modeling

Security incident management

Cloud-native environments

Tools

Linux

Tomcat

Java

Spring

Kubernetes

GCP

Job description

Senior Ethical Hacker

Hack & slash your way to retail platform safety

By wielding the sharpest digital swords in your arsenal and stealthily hacking away at anything and everything that stands between you and the prize: sneaky, backdoor entry. Obviously, you do this without nefarious intent and share your methods and findings with the team so we can take the appropriate action and close any holes you berserked your way through. In short: you go on the offensive to make our platform safer for customers and partners.

As an Ethical Hacker, you use your offensive prowess to “attack” our platform, pen‑testing on request (e.g., for product teams) and on your own initiative. You base your actions on risk priority: high‑risk threats take precedence over low‑risk stuff. Other responsibilities include reviewing technical designs/ideas, “breaking stuff on paper sessions,” vulnerability assessments of apps/systems/networks, and threat modeling to help product teams assess their own risks and those inherent in their solutions. Plus anything and everything else that needs doing, but nobody thought to mention.

You’ll join the Security Operations team of hackers, defenders, and “if it’s fixable, consider it done” problem solvers. A team where “red” and “blue” specialists blend into a beautiful purple squad that keeps the bol.com platform safe and secure. We build and run security solutions for and across the entire bol.com landscape, including customer and partner‑facing platforms, office solutions, the cloud environment, and the logistical ecosystems that keep our fulfillment centers humming and the parcels on our conveyor belts cruising. You have two direct colleagues and six “blue team” security engineers. In addition to hacking and engineering, your team is responsible for security incident management: keeping track of bol.com’s overall security position (systems and data) and running various big security projects.

Responsibilities

• Attack the platform and conduct penetration tests on request and proactively.
• Prioritize high‑risk threats over low‑risk ones.
• Review technical designs and ideas.
• “Break stuff on paper sessions.”
• Perform vulnerability assessments of applications, systems, and networks.
• Threat‑model to help product teams assess risks and inherent solution risks.
• Attend to security incident management and overall security posture.
• Run major security projects.

Qualifications

• Accomplished ethical hacker / penetration tester with deep understanding of internet‑facing web applications and cloud‑native environments.
• Provision for quick assessments as well as in‑depth pen tests, knowing when each approach works best.
• Previous experience in large engineering‑driven environments where open‑source tooling is the norm.
• Always available to software engineers with questions and ready to respond to security alerts.
• Strong familiarity with Linux, Tomcat, Java, Spring microservices, GCP, Kubernetes, and native infrastructure on the cloud.