Security Researcher / Offensive Security Engineer

Role overview

Conduct hands-on offensive security work to uncover meaningful weaknesses across networks, web applications, and APIs, then help teams understand and address the risks. The work includes penetration testing, exploit demonstrations, targeted red-team scenarios, and research into attack techniques beyond routine automated scanning.

Responsibilities

- Perform internal and external penetration tests across networks, web applications, and APIs. - Develop proof-of-concept code or custom exploits to demonstrate real-world impact. - Simulate advanced attack scenarios when needed. - Research new techniques, bypasses, and attack paths. - Turn technical findings into clear, actionable reports for technical and non-technical audiences.

Requirements

- Professional experience in offensive security or penetration testing. - Ability to write proof-of-concept code in a language such as Python, C/C++, or Ruby. - Strong understanding of web and network security, including OWASP concepts, Active Directory/Kerberos, and lateral movement. - Comfort investigating beyond automated scanner results and selecting appropriate tools for the problem. - Clear written and verbal communication with both technical and non-technical audiences.

Nice to have

- Exploit development experience beyond proof-of-concept work. - Low-level systems or reverse-engineering experience. - Contributions to security research or tooling, or a track record of finding overlooked issues. - Familiarity with tools such as Burp Suite, Metasploit, command-and-control frameworks, IDA, Ghidra, or AFL.

Benefits and work setup

- Remote work, high autonomy, and technically challenging assignments in a small team with direct communication. - The work emphasizes in-depth investigation and practical impact. A CV is optional; applicants may instead share evidence of how they approach security problems and what they have built or tested.