Senior Offensive Security Engineer

bol.com; Netherlands; On-site; EUR 90,000 - 130,000; Full time

Job summary

bol.com is seeking a Senior Offensive Security Engineer to lead pen tests, threat modeling, and secure-by-design reviews across our platform. You’ll own offensive security engagements for web apps, cloud-native services, and partner integrations.

You’ll collaborate with a diverse team of red/blue defenders, respond to incidents, and translate complex findings into actionable fixes for product teams. Deep expertise in Linux, Java ecosystem and cloud deployments is highly valued.

Qualifications

• Experience performing ethical hacking and penetration testing on web apps and cloud services.
• Strong understanding of risk-based security assessments and threat modeling.
• Familiarity with Linux, Java ecosystem and cloud deployments.

Responsibilities

• Perform penetration tests and security assessments on platforms and apps.
• Lead security reviews of designs and architectures.
• Contribute to incident response and security tooling.
• Collaborate with product teams to remediate findings.

Skills

Penetration testing

Threat modeling

Cloud security

Job description

Senior Offensive Security Engineer

By wielding the sharpest digital swords in your arsenal and stealthily hacking away at anything and everything that stands between you and the prize: sneaky, backdoor entry. Obviously, you do this without nefarious intent, you own an impressive collection of stylish hats, and they're all #FFFFFF and immediately share your methods and findings with the team so we can take the appropriate action and close any holes you berserked your way through. In short: you go on the offensive to make our platform safer for customers and partners.

As an Ethical Hacker, you use your offensive prowess to 'attack' our platform, pen testing on request (e.g., for product teams) and on your own initiative. You base your actions on risk priority: high risk threats take precedence over low risk stuff. Other responsibilities include reviewing technical designs/ideas, "breaking stuff on paper sessions," vulnerability assessments of apps/systems/networks, and threat modeling to help product teams assess their own risks and those inherent in their solutions. Plus anything and everything else that needs doing, but nobody thought to mention.

What you will do as Senior Offensive Security Engineer

You'll join the Security Operations team of hackers, defenders, and 'if it's fixable, consider it done' problem solvers. A team where 'red' and 'blue' specialists blend into a beautiful purple squad that keeps the bol.com platform safe and secure. We build and run security solutions for and across the entire bol.com landscape. That includes the 'usual suspects' like customer and partner facing platforms, office solutions, and the cloud environment, but it also encompasses the logistical ecosystems that keep our fulfillment centers humming and the parcels on our conveyor belts cruising. You have two direct colleagues (who are big on white Stetsons) and six (for now!) 'blue team' security engineers. In addition to hacking and engineering, your team is responsible for security incident management: keeping track of bol.com's overall security position (systems and data) and running various big security projects.

Because you're an accomplished ethical hacker/penetration tester with a deep understanding of internet-facing web applications and cloud-native environments. You are as adept at quick assessments as you are conducting in-depth pen tests, and know when which approach works best. Previous experience in large engineering-driven environments where open source is often the tooling of choice is a must. After all, at bol.com we ideate and build most of our solution in-house (sure, we leverage existing libraries and frameworks), so that has to appeal to you as well. We also expect you to be 'always available' to our software engineers when they have questions. And to step up to the plate if a security alert breaks the silence. Linux, tomcat, java, and spring microservices all serve us well (in the cloud, we operate native infra on GCP, e.g., Kubernetes), so affinity with those would be a major asset.

• Your resourcefulness is matched by your initiative. You don't wait for problems to solve; you find them.
• You are obsessed with details. You spot technical issues and threats that everyone else glosses over.
• You zoom in and out with gusto. You know what's important when, prioritize like a boss, and naturally zoom in on the biggest risks first.

• You are the captain chaos of white hats. You aren't exactly adept at organizing work in tools like jira, Kanban and/or scrum like work environments.
• You believe in security by obscurity. You keep your job secure by obscuring what you do: explaining threats and issues to product teams in a friendly, respectful, and understandable (!) manner is not your thing.
• You live in an ivory tower. You have a lot of redeeming qualities, but helpful and approachable you are not.