This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Sr. Principal Web Pentester. This role provides advanced offensive cybersecurity expertise, focusing on the planning and execution of complex Web and Cloud penetration testing engagements. You will own the technical planning and delivery of penetration testing engagements — from scoping and test plans through exploitation, PoC development, remediation verification, and formal reporting. You will apply a deep technical skills and offensive security experience to identify and exploit vulnerabilities in enterprise and cloud environments, helping to strengthen defenses through hands-on testing and analysis. This position involves driving high-impact testing projects, developing new testing methodologies and tools, and contributing to the organization’s overall security posture by uncovering and demonstrating real-world attack paths.
Job Responsibility:
Web and Application Penetration Testing: Performing advanced assessments of web applications, APIs, and authentication mechanisms to identify and exploit vulnerabilities across modern frameworks and architectures. Delivering actionable findings that directly inform defensive improvements
Cloud Penetration Testing: Conducting offensive security assessments in AWS, Azure, and GCP environments. Testing identity, networking, storage, and serverless components to uncover misconfigurations and privilege escalation opportunities in multi-cloud deployments
Source Code Security Review: Reviewing application and infrastructure-as-code repositories to identify insecure coding patterns, injection points, and logic flaws. Collaborating with development teams to remediate vulnerabilities early in the SDLC
Threat Modeling and SDLC Security: Partnering with engineering and product teams to identify potential attack vectors at the design phase. Performing structured threat modeling to ensure security is embedded throughout the software development lifecycle
Requirements:
Ability to take ownership of the technical planning and delivery of penetration testing engagements — from scoping and test plans through exploitation, PoC development, remediation verification, and formal reporting
Proven offensive web/app expertise: Demonstrated experience performing advanced web and API penetration tests, exploiting authentication/authorization flaws, business-logic issues, injection classes, and modern frameworks
Cloud exploitation: Hands-on experience testing and exploiting workloads and configurations in AWS, Azure, and GCP (identity, networking, storage, serverless, IaC)
Server & client platform familiarity: Strong experience with common server and client platforms that host or interact with web apps—Linux and Windows primary
macOS experience is a plus
Programming & automation: Strong scripting and tooling skills using Python, Go, or C/C++ (or equivalent) to automate testing, build proofs-of-concept, and develop internal pentest tools
Infrastructure & evasion: Experience deploying offensive infrastructure for engagements and evading/demonstrating bypasses of network and host-based controls (WAF, IDS/IPS, EDR)
Source code review & SDLC: Experience performing secure code reviews and integrating findings into the SDLC through threat modeling, developer collaboration, and security-by-design recommendations
Experience level & education: Master’s degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience
Minimum 9+ years in cybersecurity with substantial focus on offensive security and web/cloud testing
Research & innovation: Documented history of meaningful technical research, responsible disclosure, tooling contributions, or industry-visible findings (e.g., novel vulnerabilities, exploit techniques, or defensive improvements)
Nice to have:
Ability to assess ML/AI components integrated into web and cloud products — including model endpoints, inference APIs, training pipelines, and MLOps — to identify risks from prompt injection, model poisoning, data leakage, and adversarial examples
Ability to design and automate adversarial tests and prompt-fuzzers to evaluate AI model robustness, and deliver mitigation guidance to product and detection teams
Credited CVE’s, participation in bug bounty programs, security blogging, publicly available quality code or tools
Certifications such as OSCP / OSCE, GPEN, GWAPT, CRTP, OSWE, or equivalents
Experience with CI/CD and developer pipelines security (GitHub/GitLab runners, build agents, IaC scanning)
Familiarity with threat emulation frameworks and MITRE ATT&CK, OWASP TOP 10, OWASP ASVS, OWASP WSTG, STRIDE, and mappings for web/cloud scenarios
Experience authoring pentest playbooks, reusable test modules, or internal offensive tooling
What we offer:
Health & Wellbeing: comprehensive suite of benefits that supports physical, financial and emotional wellbeing
Personal & Professional Development: specific programs catered to helping you reach any career goals
Unconditional Inclusion: unconditionally inclusive in the way we work and celebrate individual uniqueness