Senior Penetration Tester – Product Security

Redlings GmbH; USA; Remote; USD 120.000 - 170.000; Vollzeit

Benefits dieser Stelle

Remote-first

Certifications budget

Conference budget

Zusammenfassung

Redlings GmbH is seeking a seasoned penetration tester to assess security across applications, APIs, backend systems, and cloud services. You will look for how weaknesses compound across layers and provide clear, reproducible guidance for fixes.

The role emphasizes hands-on testing, detailed reporting, and working with engineering teams to improve defenses. Remote-first with flexible hours and opportunities for certifications.

Qualifikationen

• Several years of hands-on web and API penetration testing.
• Strong understanding of authentication, authorization, and complex business logic.
• Working knowledge of Linux, network services, and backend systems.
• Python or scripting skills for developing personal tools.

Aufgaben

• Perform penetration tests on product software and infrastructure, including applications, APIs, backend systems, and network services.
• Investigate authentication, authorization, and business-logic weaknesses.
• Trace attack paths across components and assess exploitability.
• Write technical reports with reproducible findings and recommendations.
• Provide engineering teams with clear fixes and guidance.

Kenntnisse

Penetration testing

Web security

Authentication

Linux

Python scripting

Threat modeling

Tools

Burp Suite

Nmap

Wireshark

Kubernetes

Jobbeschreibung

Role overview

Test the security of complete products across their applications, APIs, backend systems, network services, and management interfaces. You will look beyond isolated findings to determine how weaknesses can be combined across product layers, assess realistic attacker impact, and give engineering teams clear, reproducible guidance for fixes.

Responsibilities

• Perform penetration tests on product software and infrastructure, including applications, APIs, backend systems, and network services.
• Investigate authentication, authorization, and business-logic weaknesses.
• Trace attack paths across components, such as from an API to a management interface or from cloud services to a device.
• Assess practical exploitability and explain what an attacker could achieve in the product context.
• Write technical reports with reproducible findings and recommendations that engineering teams can act on.

Requirements

• Several years of hands-on web and API penetration-testing experience.
• Strong understanding of authentication, authorization, and complex business logic.
• Working knowledge of Linux, network services, and backend systems.
• Good technical judgment about exploitability and the ability to connect weaknesses across components.
• Python or scripting skills for developing personal tools.
• Excellent technical writing in English.

Nice to have

• Kubernetes, containers, mobile application testing, or embedded and firmware knowledge.
• Familiarity with product protocols and cloud-native product architectures.

Benefits and work setup

• Permanent, remote-first position with flexible hours and lab days in Mannheim; client travel is uncommon.
• Senior-led reviews, time for research and tooling, and a budget for certifications and conferences.
• Technical work without sales targets, with opportunities to learn hardware and firmware assessment, product threat modeling, and coordinated disclosure.