Senior Penetration Tester – Product Security

Role overview Test the security of complete products across their applications, APIs, backend systems, network services, and management interfaces. You will look beyond isolated findings to determine how weaknesses can be combined across product layers, assess realistic attacker impact, and give engineering teams clear, reproducible guidance for fixes.

Responsibilities - Perform penetration tests on product software and infrastructure, including applications, APIs, backend systems, and network services. - Investigate authentication, authorization, and business-logic weaknesses. - Trace attack paths across components, such as from an API to a management interface or from cloud services to a device. - Assess practical exploitability and explain what an attacker could achieve in the product context. - Write technical reports with reproducible findings and recommendations that engineering teams can act on.

Requirements - Several years of hands-on web and API penetration-testing experience. - Strong understanding of authentication, authorization, and complex business logic. - Working knowledge of Linux, network services, and backend systems. - Good technical judgment about exploitability and the ability to connect weaknesses across components. - Python or scripting skills for developing personal tools. - Excellent technical writing in English.

Nice to have - Kubernetes, containers, mobile application testing, or embedded and firmware knowledge. - Familiarity with product protocols and cloud-native product architectures.

Benefits and work setup - Permanent, remote-first position with flexible hours and lab days in Mannheim; client travel is uncommon. - Senior-led reviews, time for research and tooling, and a budget for certifications and conferences. - Technical work without sales targets, with opportunities to learn hardware and firmware assessment, product threat modeling, and coordinated disclosure.