Ethical Hacker/Pentester

Rublon; United States; Remote; USD 45,000 - 60,000; Full time

Job summary

Rublon is seeking a security specialist to assess and improve the security of multi-factor authentication systems, focusing on authentication flows and passwordless methods. The role combines offensive security research, hands-on testing, and collaboration with product and engineering teams to translate findings into practical security improvements.

You will assess threat models, test Windows environments and WebAuthn/FIDO2, prototype passwordless approaches, and track evolving attack techniques

Qualifications

• Practical penetration-testing or ethical-hacking experience relevant to authentication or identity systems.
• Ability to analyze authentication protocols and identify security weaknesses.
• Familiarity with Windows environments, Active Directory, Kerberos, NTLM, and WebAuthn/FIDO2.

Responsibilities

• Threat-model authentication flows and examine cryptographic design for weaknesses.
• Test systems across Windows desktops and servers, directory services, Kerberos, NTLM, and WebAuthn/FIDO2.
• Prototype and validate passwordless authentication approaches, including passkeys.
• Track new attack techniques and assess their relevance to authentication security.
• Document findings clearly and work with engineering teams to support remediation and product improvements.

Skills

Penetration testing

Authentication protocols

Threat modeling

Communicate findings

Tools

Windows

Active Directory

Kerberos

NTLM

WebAuthn

Job description

Role overview

Help assess and improve the security of multi-factor authentication systems, with a focus on authentication flows and emerging passwordless methods. The work combines offensive security research, hands-on testing, and collaboration with product and engineering teams to turn findings into practical security improvements.

Responsibilities

• Threat-model authentication flows and examine their cryptographic design for weaknesses.
• Test systems across Windows desktops and servers, directory services, Kerberos, NTLM, and WebAuthn/FIDO2.
• Prototype and validate passwordless authentication approaches, including passkeys.
• Track new attack techniques and assess their relevance to authentication security.
• Document findings clearly and work with engineering teams to support remediation and product improvements.

Requirements

• Practical penetration-testing or ethical-hacking experience relevant to authentication or identity systems.
• Ability to analyze authentication protocols and identify security weaknesses.
• Familiarity with Windows environments, Active Directory, Kerberos, NTLM, and WebAuthn/FIDO2.
• Clear communication skills for reports, peer reviews, and technical discussions.

Nice to have

• Experience testing or administering Entra ID environments.
• Exposure to hardware-backed authentication factors such as TPMs, security keys, or Bluetooth proximity.
• Familiarity with red-team frameworks, threat modeling, or security certifications.
• Participation in CTFs, security communities, or publication of security research.

Benefits and work setup

The role can be performed full-time on-site in Kraków or Zielona Góra under an employment contract, or remotely within Poland on a contractor basis. The work involves close collaboration with penetration testers, cryptographers, and engineers, with findings intended to feed into product remediation.