Junior Attack Surface Analyst — Offensive AppSec (Poland)

Terra Security; Poland; On-site; PLN 60,000 - 100,000; Full time

Job summary

Terra Security invites a junior Attack Surface Analyst to join our team in Poland. You will analyze customer web applications and build accurate surface models powering Terra’s automated security testing platform.

You’ll study authentication flows, APIs, navigation, and RBAC across diverse apps, combining automated discovery with hands-on security analysis to ensure complete surface coverage before assessments begin.

Qualifications

• 0–2 years of hands‑on experience in web technologies, IT, or application security or equivalent self‑driven learning through projects, bootcamps, or CTFs.
• Strong understanding of how web applications work: HTTP methods, status codes, cookies, sessions, headers, and REST API fundamentals.
• Solid knowledge of common authentication patterns form‑based login, bearer tokens, session management, and role‑based access.
• Practical expertise with browser developer tools and an interest in proxy‑based security analysis (Burp Suite, OWASP ZAP, or similar).
• Exceptional attention to detail and methodical approach to analyzing complex application architectures.
• High‑level English proficiency fluent in reading, writing, and speaking.

Responsibilities

• Perform structured attack surface discovery - identifying endpoints, pages, API routes, and interactive functionality across authenticated and unauthenticated contexts.
• Analyze authentication flows, session handling, and role-based access to ensure testing covers the full permission model.
• Validate automated discovery output and apply reconnaissance methodology to achieve complete surface coverage.
• Document security context for each application: auth prerequisites, critical business workflows, API behavior, navigation structure, and scope constraints.
• Analyze API specifications (OpenAPI/Swagger) and traffic patterns to enrich endpoint models and parameter understanding.
• Confirm application testing readiness - verifying asset models, domain scope, and credentials before assessments are launched.
• Identify recurring architectural patterns (SPA behavior, custom auth, WAF interactions) and contribute insights that improve Terra’s discovery automation.

Skills

Web technologies

HTTP & REST APIs

Authentication patterns

Browser developer tools

Attention to detail

English proficiency

Education

Security-related degree or equivalent training

Tools

Burp Suite

OWASP ZAP

OpenAPI/Swagger

Job description

Terra Security invites a junior Attack Surface Analyst to join our team in Poland. You will analyze customer web applications and build accurate surface models powering Terra’s automated security testing platform.

You’ll study authentication flows, APIs, navigation, and RBAC across diverse apps, combining automated discovery with hands-on security analysis to ensure complete surface coverage before assessments begin.