Offensive Security Engineer: Pen Testing & IR (Hybrid)

thales; Leça do Balio; Hybrid; EUR 42,000 - 68,000; Full time

Benefits offered by this job

Hybrid/office flexibility

International exposure

Job summary

Thales is seeking a skilled Penetration Tester to support offensive security assessments across enterprise environments. You will identify vulnerabilities, simulate real-world attacks, and work closely with DFIR, SOC, and security operations teams to improve detection and response capabilities.

The role combines hands-on testing with incident response support, threat investigations, and ongoing security improvement initiatives, with hybrid/office flexibility based on local policy.

Qualifications

• At least 3 years of experience in penetration testing or offensive security.
• Hands-on testing across web, API, network, cloud, and AD security.
• Experience supporting or collaborating with incident response (DFIR) teams.
• Strong ability to communicate findings to both technical and non-technical audiences.

Responsibilities

• Conduct web, network, cloud, and Active Directory penetration tests using modern offensive security techniques and tools.
• Support incident response engagements, including forensic analysis, threat hunting, containment validation, and attacker activity reconstruction.
• Prepare detailed technical reports and executive summaries with clear, actionable remediation recommendations.
• Collaborate with blue team, DFIR, SOC, and security engineering teams to improve detection capabilities and validate security controls.
• Contribute to strengthening the organization''s cyber resilience through proactive testing and technical analysis.

Skills

Penetration testing

Offensive security

Web security

API security

Network security

Cloud security

Active Directory security

DFIR collaboration

Communication

Job description

Thales is seeking a skilled Penetration Tester to support offensive security assessments across enterprise environments. You will identify vulnerabilities, simulate real-world attacks, and work closely with DFIR, SOC, and security operations teams to improve detection and response capabilities.

The role combines hands-on testing with incident response support, threat investigations, and ongoing security improvement initiatives, with hybrid/office flexibility based on local policy.