Пентестер вакансии

Обязанности: — RedTeam/Пентест сетевого периметра, доменной и платежной инфраструктуры (blackbox, greybox, whitebox) — Анализ защищённости беспроводных сетей — Оптимизация и повышение уровня информационной инфраструктурной и сетевой безопасности — Мониторинг рынка актуальных угроз информационной безопасности — Участие в R&D проектах Требования: — Опыт работы от 2х лет в качестве пентестера инфраструктуры — Отличное знание как минимум одного языка программирования (go, java, python, php) и умение читать и анализировать исходный код на распространенных языках программирования — Уверенное владение методикой проведения инфраструктурных пентестов — Отличное знание сетевых протоколов (TCP/IP), атак на них и обход механизмов защиты — Навыки тестирования на проникновение и поиска уязвимостей с предоставлением отчетов — Уверенное владение специализированным ПО и фреймворками для проведения различных видов тестирований (Burp Suite, Metasploit, PowerSploit, BloodHound, Cobalt-Strike, Impacket) — Опыт администрирования *nix и Windows-систем, web-серверов — Знание технологий виртуализации (ESXi, Hyper-V) и контейнеризации (Docker, Kubernetes), а также атак на них — Английский язык – не ниже уровня intermediate (Чтение технической литературы) Будет плюсом: — Сертификация в области практической безопасности (OSCP/OSCE/OSEP/GWAPT/GPEN и т.д.) — Участие в CTF (task-based или attack-defense) и прохождение спец. лабораторий (standoff365, hackthebox, pentester academy) — Опыт проведения комплексного анализ защищенности платежных инфраструктур и ДБО — Участие в Red Team Условия: — Зарплатные условия обсуждаются по итогам собеседования — Режим работы офис\Гибрид\удаленка обсуждаются по итогам интервью — Есть 2 коворкинга на Алтае и Сочи доступные для работы 1 раз в год — Погружение в ИИ-культуру – взаимодействуем с искусственным интеллектом на постоянной основе и обучаем этому новичков, предоставляем бесплатных ИИ-помощников — Стандартные + большой компании: ДМС, обучения, возможность участия в различных общих активностях от D&D до марафона

Location: Remote; Serbia; Poland Workplace: Remote We are looking for a Senior Penetration Tester to strengthen the security of high-load products by identifying vulnerabilities across applications, infrastructure, cloud environments, and payment flows. In this role, you will work closely with engineering, product, fraud, and compliance teams to improve security posture through offensive security assessments and practical remediation. Responsibilities: - Plan and execute penetration testing activities across web applications, APIs, mobile applications, internal and external infrastructure, and AWS cloud environments - Perform offensive security exercises, including red team and assumed-breach scenarios covering privilege escalation, lateral movement, persistence, and data exfiltration - Assess the security of cloud-native services, Kubernetes environments, microservices, and CI/CD pipelines - Identify vulnerabilities affecting payment systems, wallets, KYC/AML processes, bonus mechanisms, affiliate tracking, and other business-critical workflows - Work with Product, Engineering, AppSec, Payments, and Fraud teams to prioritize findings and support remediation efforts - Develop custom scripts and internal tools to improve testing capabilities where standard solutions are insufficient - Contribute to threat modeling activities and support secure-by-design initiatives - Review penetration testing plans, reports, and provide technical guidance to junior and middle security specialists - Research emerging vulnerabilities, MITRE ATT&CK techniques, security advisories, and translate them into actionable improvements - Support security assessments for new products, releases, and market launches, including effort estimation and pre-certification activities - Act as a security advisor for technical and business stakeholders on offensive security matters Requirements: - 4+ years of hands-on experience in penetration testing or offensive security - Proven practical experience in at least three of the following areas: - Web applications / APIs - Internal networks - External infrastructure - Cloud environments (AWS/GCP) - Mobile applications (iOS/Android) - OSCP or an equivalent offensive security certification - Strong knowledge of SAST, SCA, DAST, AWS/GCP, MITRE ATT&CK, OWASP ASVS, OWASP WSTG, and PTES - Good understanding of application architecture, including MVC and data flow principles - Knowledge of supply chain attack techniques - Experience writing scripts in Python and Bash - Understanding of IAM models within at least one major cloud provider - Hands-on experience testing Kubernetes-based environments, cloud-native applications, CI/CD pipelines (GitLab, GitHub Actions, Jenkins) and Infrastructure as Code solutions (Terraform, Helm, CloudFormation) - Strong reporting, documentation, and communication skills - Ability to balance security priorities with business and release deadlines - Solid understanding of security frameworks and compliance standards, including PCI DSS, ISO 27001, NIST, and GDPR - At least Upper-Intermediate level of English Would be a plus: - Advanced offensive security certifications such as OSWE, OSEP, OSED, CRTO, BSCP, ARTE, or GRTE - Experience designing secure architectures for Kubernetes and AWS environments - Previous background in iGaming, fintech, or payment products - Public security research, CVEs, advisories, technical publications, or conference presentations - Completion of HTB Pro Labs or strong CTF achievements - Contributions to open-source offensive or defensive security projects What's in it for you: - Fully remote working format - Competitive salary based on experience - Paid annual leave and sick leave - Opportunities for professional and career growth - Supportive environment focused on continuous development and long-term growth

Location: Remote Workplace: remote At Offchain, we aren’t just building products: we’re leading a movement.    As pioneers in blockchain scalability and security, we're at the forefront of transforming how the world interacts with decentralized applications. We're laying the foundation that will define the next generation of digital commerce, governance, and human interaction. This involves tackling real-world challenges that come with scaling blockchain technology, without compromising on its core principles: decentralization, security and transparency.    At the center of this vision is our people. Our team is made up of thinkers and doers that embrace new challenges and seek solutions that push existing boundaries. If you’re energized by solving unprecedented problems, and believe in the role that decentralized systems will play in creating a more equitable digital future, then we want to hear from you.    Why Offchain?   Offchain is setting the pace for the entire Ethereum ecosystem. We built the Arbitrum stack that powers Arbitrum One, the most widely adopted Ethereum scaling solution that exists today.   Arbitrum’s ecosystem is undergoing tremendous growth with hundreds of projects and dApps on Arbitrum One today. Over 100 different teams have used Offchain technology to build their own Arbitrum chains. Major players in the space, Robinhood, BlackRock, Ethena Labs, Securitize, Aave, and Apechain are all using the Arbitrum stack.   Arbitrum’s thriving ecosystem wouldn’t exist without our advanced technology stack. Arbitrum, Prysm, ZeroDev. These aren’t just product names. These are tools that are actively reshaping what's possible on Ethereum and advancing its core infrastructure.   To top it all off? We’re backed by $124 million in funding. We’ve demonstrated consistent execution with billions in secured value, thousands of supported projects, and infrastructure processing millions of transactions seamlessly. The Role As a Senior Security Engineer at Offchain, you will emulate the real-world tactics, techniques, and procedures of sophisticated adversaries to surface vulnerabilities across our infrastructure and ecosystem tools. You’ll run hands-on penetration tests, lead red team exercises, and work side-by-side with blue team partners to test, refine, and strengthen detection and response capabilities. Your efforts will directly shape how Offchain designs, launches, protects, and achieves compliance for the infrastructure that powers millions of users and applications - including key standards such as SOC 2. What you'll do: Conduct comprehensive code audits across a variety of internal applications and infrastructure. Conduct comprehensive penetration tests across cloud environments (AWS), infrastructure, and backend applications. Collaborate with detection engineering, threat intelligence, and incident response groups to review security controls, uncover coverage gaps, and enhance overall detection quality. Build, maintain, and evolve custom offensive tools, scripts, and automation frameworks to increase assessment speed. Offer offensive security expertise during incident investigations, including log analysis and root cause reviews. Keep up with evolving threats, vulnerabilities, and attack methods; share research internally and engage with the wider security community. Own offensive security projects from start to finish, mentor junior team members, and cultivate a culture of ongoing learning and knowledge exchange. What you'll need: 5+ years of experience in offensive security, penetration testing, red teaming, or a closely related field. Extensive experience with conducting code audits to identify and remediate security issues. Experience with binary exploitation. Mastery of AWS & specific attack techniques and configuration weaknesses. Strong understanding of adversary tactics and frameworks like MITRE ATT&CK. In-depth knowledge of web application security, including OWASP Top 10, ASVS, and common vulnerability categories. Proficiency using offensive security tools such as Burp Suite, nuclei and similar frameworks. Strong programming skills in Python, Go, or similar languages, with proven experience developing tools or automation. Excellent written and verbal communication skills, with the ability to present complex technical details as clear, risk-focused recommendations. A natural ability to think like an attacker - creative, determined, and skilled at assessing risk across complex systems. Nice-to-haves Web3 / blockchain security exposure: smart contract auditing, bug bounty hunting (e.g., Immunefi, Code4rena), or DeFi protocol review. Familiarity with Ethereum L1 / L2 node architecture and security risks. Experience in blockchain infrastructure penetration testing. Perks: Remote-first global workforce + NY office Professional reimbursement program (facilitates industry conference attendance, certifications, and more) Medical, dental & vision coverage (US + some other countries) 401k retirement plan + company match (US only) Wellness stipend Home office set up / ergonomic equipment program

Location: Yerevan, Armenia Description: Digitain now welcomes a highly skilled and motivated Middle Penetration Tester to join our team. The ideal candidate is expected to be responsible for identifying and evaluating vulnerabilities in our clients' systems and applications, conducting penetration testing exercises, and providing recommendations for enhancing security measures. You will work closely with cross-functional teams to ensure the implementation of robust security controls and mitigate potential risks. Responsibilities: Conduct comprehensive penetration testing on various systems, applications, and networks to identify vulnerabilities, weaknesses, and potential security risks Execute manual and automated testing methodologies to identify security flaws in networks, web applications, mobile applications, and infrastructure components Perform analysis and validation of security findings, and provide detailed reports outlining the identified vulnerabilities and potential impact to stakeholders Collaborate with development teams, system administrators, and other stakeholders to provide remediation recommendations and follow up on the implementation of necessary security controls Stay up to date with the latest security threats, vulnerabilities, and attack techniques, and incorporate this knowledge into penetration testing methodologies Contribute to the improvement of existing penetration testing frameworks, tools, and processes to enhance efficiency and effectiveness Assist in the development and maintenance of security policies, procedures, and guidelines Participate in incident response activities, including investigation and remediation of security incidents Provide guidance and mentorship to junior members of the team, assisting in their skill development and knowledge enhancement Requirements: At least 2 years of experience in penetration testing or QA Bachelor's degree in Computer Science, Information Security, or a related field Proven experience in conducting penetration testing and vulnerability assessments in a professional setting In-depth knowledge of network protocols, web application architecture, operating systems, and common security vulnerabilities Proficiency in using a variety of penetration testing tools, frameworks, and methodologies Strong understanding of common security standards, such as OWASP, NIST, and ISO 27001 Familiarity with regulatory compliance requirements, such as GDPR, HIPAA, or PCI DSS Excellent problem-solving and analytical skills, with the ability to think creatively and out-of-the-box Strong written and verbal communication skills, with the ability to clearly articulate technical concepts to both technical and non-technical stakeholders Ability to work effectively both independently and collaboratively in a fast-paced and dynamic environment High ethical standards, integrity, and a commitment to maintaining confidentiality Join our team and play a crucial role in strengthening the security posture of our clients. As a Middle Penetration Tester, you will have the opportunity to continuously enhance your skills and contribute to the protection of sensitive data and critical systems.