Responsibilities- Findings Verification: Reproduce and validate mitigation of vulnerabilities using tools such as Burp Suite.- Technical Quality Assurance: Perform in-depth reviews of penetration testing reports to ensure clarity, completeness, technical accuracy, and reproducibility of findings.- Scoping Support: Collaborate with Exposure Managers, Application Owners, and Technology teams to define appropriate and risk‑based scopes for external penetration testing engagements.- Hardening Baseline: Discuss with Technology teams and architects hardening options to collectively define safe and resilient baseline choices.- Technical Advisory: Serve as the technical point of contact for questions related to technology security testing methodologies, findings interpretation, and remediation approaches.- Tooling & Techniques: Utilize industry‑standard tools (e.G., Burp Suite, Nmap) and manual techniques to validate vulnerabilities across web applications, APIs, and supporting infrastructure.- Standards Alignment: Ensure testing approaches and findings align with industry’s best practices (e.G., OWASP Testing Guide, OWASP Top 10) and internal security standards.- False Positive Management: Analyze and challenge reported vulnerabilities where necessary, identifying false positives and ensuring appropriate classification.- Remediation Support: Provide technical guidance to development and infrastructure teams on how to address identified vulnerabilities effectively and sustainably.- Knowledge Sharing: Contribute to the continuous improvement of internal practices by sharing insights, patterns, and lessons learned across teams.- Collaboration:



Work closely with Exposure Managers and general technical experts to ensure consistent quality and execution across all penetration testing activities.Requirements- Bachelor’s degree in computer science, information security, or equivalent practical experience.- 3–5 years of hands‑on experience in penetration testing, application security, or vulnerability assessment.- Strong practical experience with web application security testing and tools (e.G., Burp Suite).- Solid understanding of common vulnerabilities (e.G., OWASP Top 10) and exploitation techniques.- Ability to read, understand, and reproduce technical findings from penetration testing reports.- Experience with HTTP/S protocols, authentication mechanisms, and modern web architectures (APIs, microservices).- Strong analytical and problem‑solving skills with attention to detail.- Effective communication skills, especially in explaining technical issues to non‑technical stakeholders.- Professional proficiency in English and Spanish; eligible to work in Spain.Preferred Qualifications- Relevant certifications (e.G., OSCP, eWPT, CEH, GWAPT, Burp Suite Certified Practitioner).- Experience reviewing third‑party security assessment reports or managing testing vendors.- Familiarity with infrastructure/network penetration testing concepts.- Experience in secure code review or secure development practices.- Scripting or programming skills (e.G., Python, JavaScript) for automation or advanced testing.- Experience in financial services or regulated environments.- Exposure to CI/CD security integration or DevSecOps practices.- German language skills.#J-18808-Ljbffr

📌 Exposure Management Technical Expert 100% (F/M/D) (Madrid)
🏢 Bank Julius Bär Ltd.
📍 Madrid