Ethical Hacker/Pentester

Role overview Help assess and improve the security of multi-factor authentication systems, with a focus on authentication flows and emerging passwordless methods. The work combines offensive security research, hands-on testing, and collaboration with product and engineering teams to turn findings into practical security improvements.

Responsibilities - Threat-model authentication flows and examine their cryptographic design for weaknesses. - Test systems across Windows desktops and servers, directory services, Kerberos, NTLM, and WebAuthn/FIDO2. - Prototype and validate passwordless authentication approaches, including passkeys. - Track new attack techniques and assess their relevance to authentication security. - Document findings clearly and work with engineering teams to support remediation and product improvements.

Requirements - Practical penetration-testing or ethical-hacking experience relevant to authentication or identity systems. - Ability to analyze authentication protocols and identify security weaknesses. - Familiarity with Windows environments, Active Directory, Kerberos, NTLM, and WebAuthn/FIDO2. - Clear communication skills for reports, peer reviews, and technical discussions.

Nice to have - Experience testing or administering Entra ID environments. - Exposure to hardware-backed authentication factors such as TPMs, security keys, or Bluetooth proximity. - Familiarity with red-team frameworks, threat modeling, or security certifications. - Participation in CTFs, security communities, or publication of security research.

Benefits and work setup The role can be performed full-time on-site in Kraków or Zielona Góra under an employment contract, or remotely within Poland on a contractor basis. The work involves close collaboration with penetration testers, cryptographers, and engineers, with findings intended to feed into product remediation.