Offensive Security Engineer / Penetration Tester
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Offensive Security Engineer conducting web, mobile, Active Directory and cloud penetration tests for Genesis’s global product IT ecosystem. Building automation and AI-agent workflows for offensive security.
Responsibilities:
- Deliver end-to-end penetration tests of web and mobile applications, Active Directory and cloud environments
- Handle engagements from scoping and reconnaissance through exploitation, post-exploitation, evidence collection and retesting
- Validate findings from Application Security and Infrastructure Security services
- Triage automated scan output by eliminating false positives, confirming exploitability and business impact, and assigning accurate risk ratings
- Write client-facing technical reports in English with reproduction steps, evidence, business-impact framing and practical remediation guidance
- Communicate directly with clients through kick-off calls, status updates, report walkthroughs, remediation Q&A and retest agreement
- Build automation and internal tooling to shorten reconnaissance, enumeration and active-scanning phases
- Develop AI-agent-based workflows for offensive security testing
- Create and maintain internal methodology, testing checklists and knowledge bases
- Research new attack techniques, evaluate tooling and share findings with the team
- Deliver client engagements end to end in the first months
- Build the internal methodology for AWS cloud security assessment
- Become the team's reference point on at least one platform within a year
Requirements:
- 2.5+ years of hands-on commercial penetration testing experience
- Several penetration-testing engagements delivered end to end
- Experience writing penetration-testing reports
- At least one practical certification — OSCP, CPTS, GPEN or CWEE, or a proven equivalent
- Web application testing according to the OWASP Web Security Testing Guide and beyond
- Experience identifying authentication and authorisation flaws, IDOR, injection, SSRF, insecure deserialization and business-logic abuse
- Burp Suite Professional as a daily tool
- Mobile application testing based on OWASP MASTG for Android and/or iOS
- Static and dynamic mobile application analysis
- Traffic interception and certificate-pinning bypass
- Knowledge of insecure local storage, IPC and platform misuse
- Working knowledge of Active Directory and internal network attacks
- Knowledge of enumeration, Kerberos abuse, credential relaying, lateral movement and privilege-escalation paths
- Scripting in Python and/or Bash
- Ability to read application source code and trace vulnerable patterns in at least one of PHP, Java, C#, JS/TS or Python
- English at B2 or above
- Nice-to-have: second practical certification: BSCP, CWEE, CAPE, GWAPT, OSWE, CRTO, eWPTX or eMAPT
- Nice-to-have: cloud security testing in AWS, Azure or GCP
- Nice-to-have: hands-on experience or genuine interest in AI and LLM security
- Nice-to-have: public technical contributions such as CVEs, open-source tooling, research write-ups, conference talks or high-quality bug-bounty reports
Benefits:
- Flexible hours and the option to work from anywhere that suits you
- Medical insurance
- 20 paid vacation days per year
- Unlimited sick leave
- All the equipment you need for work
- Compensation for professional training
- Access to the internal learning platform and lectures
- Corporate events and networking
- Free sports training
- Corporate discounts
- Massage when visiting the office
- Support for colleagues and their families serving in the Defence Forces
- Support for veterans
- Assistance in case of harm to health or property caused by the war
Similar Jobs
Managing Director, Enterprise Security Architecture – Engineering
Managing Director leading enterprise security architecture and cybersecurity platforms for The Cigna Group. Advancing cloud, DevSecOps, AI security, and cyber defense at scale.
Senior Data Security Specialist – Data Security Strategy
Especialista sênior liderando estratégia de segurança e governança de dados corporativos. Proteção de informações sensíveis com DLP, DSPM, Purview e ambientes cloud.
Senior Manager, Global Security Technology
Global Security Technology leader shaping strategy, platforms, and modernization. Managing enterprise security projects, vendors, budgets, and global capability delivery for Johnson & Johnson healthcare operations.
Industry Sales Director – Security, Surveillance & Video Connectivity
Industry Sales Director driving enterprise sales, account expansion, and partner growth for Webbing’s global cellular connectivity platform. Owning the Security & Video vertical worldwide.
Senior Information Security Engineer
Senior Security Engineer owning KPA’s enterprise security platforms, cloud, identity, and automation. Improving security across workplace-safety software, infrastructure, DevOps, and compliance environments.
Senior Software Engineer, Security
Security engineer building automated application and infrastructure security for Flex’s AI-native private bank. Protecting money movement, cloud access, vulnerability management, and secure development at scale.
Chief Information Security Officer – CISO
CISO leading cybersecurity strategy, operations, risk, and resilience for Sydney Airport’s critical aviation infrastructure. Advising executives and the Board while developing high-performing security teams.
Information Security Program Manager
Information security program manager managing U.S. customer portfolios for Cofense, a phishing defense company. Delivering simulated phishing programs, remediation reporting, and security guidance.
Head of IT, Security
Head of IT and Security owning identity, compliance, IT, and application security. Protecting OpenEd’s education platform and data for over 100,000 students.
Information Security Specialist – SoD Governance, Segregation of Duties
Especialista em segurança da informação governando SoD, IAM e RBAC na Avvale. Mitigação de riscos de acesso e conformidade para soluções empresariais inovadoras e sustentáveis.
Principal Security Engineer
Principal Security Engineer governing Fortive’s multi-cloud, AI, GitHub, and security architecture. Advising executives and leading enterprise technology strategy, governance, security, and modernization.
Security Engineering Lead
Security Engineering Lead building Product Security for Attio’s AI-native CRM. Securing customer data, leading incident response, and hiring the security team.
Security Engineering Lead
Security Engineering Lead building Attio’s Product Security function for its AI-native CRM platform. Leading application security, incident response, and security team growth.
Senior Cloud Security Engineer
Senior Cloud Security Engineer securing Omilia’s AWS conversational AI platform. Automating Terraform, GitOps, CI/CD, and cloud compliance across distributed engineering teams.
Consultor Sailpoint ISC – Identity Security Cloud
Consultor SailPoint ISC en Devoteam, consultora europea de estrategia digital y ciberseguridad. Despliegue, integración y evolución de soluciones Cyber IAM para clientes.
Senior Security Engineer – AI Focus
Senior Security Engineer securing AI/ML systems for Euna Solutions, a cloud-based public-sector software provider. Driving AI security, automation, governance, and compliance across the development lifecycle.
Senior Security Engineer – AI Focus
Senior Security Engineer securing AI/ML systems at Euna Solutions, a cloud software provider for public-sector organizations. Driving AI security automation, governance, compliance, and secure development practices.
R&D Cybersecurity Engineer
Sentar cybersecurity engineer supporting DLA research and development efforts. Administering Okta infrastructure, operational systems, networking, automation, maintenance, and user support.
Visiting Professor, Cybersecurity
Online cybersecurity professor teaching undergraduate and graduate students at DeVry University. Developing course materials, assessing learning, and integrating responsible AI and applied security practices.
Principal Information Security Engineer
Principal Information Security Engineer securing ASRC Federal’s DSOP platform for the U.S. Department of Defense. Assessing Kubernetes and containers, managing vulnerabilities, and integrating zero-trust controls across DevSecOps environments.