Careers / Open position
Penetration Tester (Web / API)
Hands-on web, API and cloud testing with evidence-backed reporting.
Europe · Senior
Minimum certification: OSCP or OSWE
Role details
What you would do
- Test web applications and APIs by hand, from authentication to business logic
- Assess the cloud services and infrastructure those applications run on
- Chain lower-severity issues into demonstrable, evidence-backed impact
- Write clear findings and walk client engineers through remediation
Minimum requirements
- An earned OSCP or OSWE certification. Course attendance or a planned exam does not meet this requirement.
- Independent manual testing of web applications and APIs: authentication, authorisation, session handling and business logic.
- Ability to read application code and write scripts to investigate and reproduce security issues.
- Clear technical reporting in English, with reproducible evidence and practical remediation guidance.
- Relevant hands-on work you can explain and demonstrate during a technical assessment.
Additional strengths (optional)
- OSWE if you already hold OSCP; experience with source-assisted web testing.
- Experience testing cloud services and the infrastructure supporting web applications.
What to include in a technical application
Use the application link for the relevant role and email [email protected] with:
- The role you are applying for and a relevant CV.
- Your earned certifications, including the required one; add a public verification link where available.
- One or two examples of your own technical work: research, a write-up, an advisory, a tool or a laboratory demonstration.
- A short explanation of your contribution and the technical work you want to do.
Do not send client data or material covered by an NDA. A laboratory example is suitable when professional work is confidential.
Hiring process
How hiring works for this role
Eligibility review and introduction
We first review the required role-specific certification, relevant experience and work examples. Candidates who meet the minimum requirements are invited to an introductory conversation with a senior team member.
Technical session
Either a practical exercise or a walkthrough of work you have already done, such as a CVE, a write-up or a tool you built. We care about how you reason, not trick questions.
Meet the team
You meet the people you would work with day to day. We talk through real engagements, how the team operates and where you would fit.
Offer
If it is a match on both sides, we make you an offer and agree the details with you directly, including how and where you will work.
Apply for this role
Use the email button and include the application details above. Please do not share confidential client information.