Offensive Security Specialist

Etiya; Fatih; In loco; TRY 260.000 - 380.000; Tempo pieno

Descrizione del lavoro

Etiya seeks an Offensive Security Specialist to conduct security assessments across applications, infrastructure, Kubernetes environments and AI/LLM‑based systems, and to perform security‑focused code reviews and remediation support.

You will plan and execute tests, validate vulnerabilities with PoCs, and collaborate with development teams to strengthen defenses while reporting findings clearly in English. A minimum of 2 years in offensive security is required.

Competenze

• 2+ years of professional offensive security experience with hands-on testing across web apps, APIs and enterprise infra.
• Strong understanding of common vulnerabilities, attack techniques and testing methodologies.
• Experience testing authentication, authorization and business logic in web apps and APIs.
• Hands-on Kubernetes security testing including RBAC, service accounts, secrets management and privilege escalation scenarios.
• AI/LLM security testing including prompt injection and data disclosure.
• Proficiency with Burp Suite, Nmap, and manual validation beyond automated scans.

Mansioni

• Plan and execute penetration tests within scopes and rules of engagement.
• Perform manual security testing of web applications, APIs and enterprise infrastructure.
• Assess Kubernetes clusters and container workloads for misconfigurations, access control weaknesses and exploitable attack paths.
• Test AI/LLM-based applications for prompt injection, sensitive data disclosure, model abuse and unauthorized actions through integrated tools.
• Contribute to cloud security assessments according to project requirements and experience.
• Perform security-focused source code reviews and static application security testing (SAST) to identify vulnerabilities in application code.
• Review and triage code scanning findings, validate their exploitability and impact, filter out false positives and prioritize confirmed vulnerabilities for remediation.
• Validate vulnerabilities and develop controlled PoCs to demonstrate their technical and business impact.
• Prepare clear reports covering evidence, reproduction steps, risk assessment and remediation recommendations.
• Work with development and infrastructure teams to explain findings, recommend fixes and perform targeted retesting to verify remediation.
• Support Red Team engagements and attack scenario development under the guidance of senior team members.
• Develop scripts and utilities to improve testing efficiency and consistency.
• Research emerging vulnerabilities and attack techniques relevant to the environments being assessed.
• Contribute to the improvement of testing methodologies, internal documentation and team knowledge sharing.

Conoscenze

Penetration testing

Kubernetes security

AI/LLM security testing

Python scripting

Vulnerability analysis

Report writing

Formazione

BS/MS in Computer Engineering or Cyber Security or related field

Strumenti

Burp Suite

Nmap

Exploitation tools

Descrizione del lavoro

We are a community of innovators, dreamers, and doers. We welcome likeminded teamplayers to #ExceedEveryday with us!

WHO ARE WE?

We are a global software company with more than 1600 employees in 3 continents, providing AI-driven digital transformation with our award-winning product portfolio.

We have offices and customers in Turkiye, Canada, Ukraine, Netherlands, USA, Singapore and UAE and have been recognized and awarded by independent organizations worldwide.

Etiya has been awarded with the "Great Place to Work Certificate" for three years in a row. And also Etiya has been listed in the "Türkiye’s Best Workplaces", "Best Workplaces in Information Technology", "Best Workplaces for Women", “Best Workplaces for Millennials” and "Innovation by All" by Great Place to Work Turkey.

WHY ETIYA?

We contribute to the continuous improvement of our people through extensive technical, leadership and soft skill training. We offer a dynamic work environment with a unique opportunity to work across diverse international projects as an organization rapidly growing in 3 continents.

We offer an innovative work environment by continuous investment in research and development.

Friendly Atmosphere

We offer a flat, open, fun and warm work environment for our employees balancing our commitment to customer success with our focus on personal development, interests and passions.

QUALIFICATIONS WE ARE LOOKING FOR

• BS or MS in Computer Engineering, Cyber Security or a related field, or equivalent practical experience.
• Minimum 2 years of professional experience in offensive security, with hands‑on penetration testing experience across web applications, APIs and enterprise infrastructure.
• Strong understanding of common security vulnerabilities, attack techniques and penetration testing methodologies.
• Practical experience testing authentication, authorization and business logic in web applications and APIs.
• Hands‑on experience in Kubernetes and container security testing, including RBAC, service accounts, exposed workloads, secrets management and privilege escalation scenarios.
• Hands‑on experience in AI/LLM security testing, including prompt injection, sensitive data disclosure, model abuse and unauthorized tool‑use scenarios.
• Proficiency in Burp Suite, Nmap and relevant exploitation tools, with the ability to manually validate findings beyond automated scanning.
• Working knowledge of networking, Linux and Windows environments.
• Scripting skills in Python, Bash or PowerShell to automate testing tasks and adapt existing tools.
• Ability to analyze relevant CVEs, reproduce vulnerabilities and develop controlled Proof‑of‑Concept (PoC) demonstrations.
• Ability to produce clear security reports with reproducible findings, impact assessments and actionable remediation guidance.
• Good written and spoken English, including the ability to communicate technical findings.
• A collaborative approach, strong analytical skills and attention to testing scope, confidentiality and rules of engagement.

JOB DESCRIPTION

The Offensive Security Specialist will conduct security assessments across applications, infrastructure, Kubernetes environments and AI/LLM‑based systems, perform security‑focused code reviews, demonstrate the impact of validated vulnerabilities and support remediation in collaboration with relevant technical teams.

Responsibilities include:

• Plan and execute penetration tests within agreed scopes and rules of engagement.
• Perform manual security testing of web applications, APIs and enterprise infrastructure.
• Assess Kubernetes clusters and containerized workloads for misconfigurations, access control weaknesses and exploitable attack paths.
• Test AI/LLM‑based applications for prompt injection, sensitive data disclosure, model abuse and unauthorized actions through integrated tools.
• Contribute to cloud security assessments according to project requirements and experience.
• Perform security‑focused source code reviews and static application security testing (SAST) to identify vulnerabilities in application code.
• Review and triage code scanning findings, validate their exploitability and impact, filter out false positives and prioritize confirmed vulnerabilities for remediation.
• Validate vulnerabilities and develop controlled PoCs to demonstrate their technical and business impact.
• Prepare clear reports covering evidence, reproduction steps, risk assessment and remediation recommendations.
• Work with development and infrastructure teams to explain findings, recommend fixes and perform targeted retesting to verify remediation.
• Support Red Team engagements and attack scenario development under the guidance of senior team members.
• Develop scripts and utilities to improve testing efficiency and consistency.
• Research emerging vulnerabilities and attack techniques relevant to the environments being assessed.
• Contribute to the improvement of testing methodologies, internal documentation and team knowledge sharing.

Applications will be reviewed and will be kept strictly confidential.

You can find information about the processing of your personal data within the scope of privacy regulations such as PDPL and GDPR from the privacy policies on our website https://www.etiya.com/privacy