Offensive security engineer

Описание: One of the companies we work with at Joppy, a TOP Startup, is looking for an Offensive Security Engineer to join the team.

• Perform proactive penetration testing across company’s applications, APIs, infrastructure, and AI-powered features.
• Reproduce and validate vulnerability reports submitted by third parties, like our bug bounty program.
• Collaborate with development teams to remediate security findings and enhance secure coding practices.
• Improve how we validate, triage, and remediate vulnerabilities from bug bounty reports, internal testing, automated controls, and external research.
• Hunt for recurring or legacy vulnerability patterns based on root cause analysis, previous incidents, and security findings.
• Build and improve security automations, agents, skills, and CI/CD controls that help engineering teams catch and fix issues earlier.
• Help secure company’s use of AI across product and internal workflows, including LLMs, agents, data access, tools, permissions, and abuse scenarios.
• Contribute to the development of our security tools, automations, and infrastructure.
• Stay up-to-date with the latest security research, threats, attack techniques, and emerging AI security risks.

• You have 4+ years of professional experience in Application Security, Offensive Security, or Penetration Testing.
• Web Application Penetration Testing experience is mandatory.
• You hold a degree in Engineering or Computer Science and have strong knowledge of web applications, databases, network protocols, and operating systems.
• You possess strong knowledge in cybersecurity fundamentals, CVSS, testing methodologies, and tooling.
• You are fluent with scripting or programming languages used in security testing and automation, such as Python or Bash.
• You are technical, curious, and comfortable moving across different security problems instead of specializing in only one area.
• You like to attack systems, but you also enjoy building tools, automations, guardrails, and practical solutions that make security scale.
• You do not need to be an expert in every technology, but you should be able to reason critically, learn fast, use AI effectively, and design pragmatic solutions.
• You have curiosity and willingness to learn about AI security topics such as LLM testing, prompt injection, agentic workflows, data exposure, tool permissions, RAG security, and secure AI adoption.
• Fluency in English is required.
• Будет плюсом: Certifications like BSCP or eWPTX are highly regarded but not mandatory; Experience with Ruby / Ruby on Rails applications is highly regarded, but not mandatory

• Collaborative, multicultural, and high-growth work environment
• Private health insurance
• Access to gym, pools, and wellness programs
• Savings on expenses
• Language classes
• Office breakfasts and organic fruit
• Exclusive discounts on meals
• Free coffee and tea
• Pet-friendly environment