Описание: One of the companies we work with at Joppy, a TOP Startup, is looking for an Offensive Security Engineer to join the team. Задачи:
* Perform proactive penetration testing across company’s applications, APIs, infrastructure, and AI-powered features.
* Reproduce and validate vulnerability reports submitted by third parties, like our bug bounty program.
* Collaborate with development teams to remediate security findings and enhance secure coding practices.
* Improve how we validate, triage, and remediate vulnerabilities from bug bounty reports, internal testing, automated controls, and external research.
* Hunt for recurring or legacy vulnerability patterns based on root cause analysis, previous incidents, and security findings.
* Build and improve security automations, agents, skills, and CI/CD controls that help engineering teams catch and fix issues earlier.
* Help secure company’s use of AI across product and internal workflows, including LLMs, agents, data access, tools, permissions, and abuse scenarios.
* Contribute to the development of our security tools, automations, and infrastructure.
* Stay up-to-date with the latest security research, threats, attack techniques, and emerging AI security risks. Требования:
* You have 4+ years of professional experience in Application Security, Offensive Security, or Penetration Testing.
* Web Application Penetration Testing experience is mandatory.
* You hold a degree in Engineering or Computer Science and have strong knowledge of web applications,



databases, network protocols, and operating systems.
* You possess strong knowledge in cybersecurity fundamentals, CVSS, testing methodologies, and tooling.
* You are fluent with scripting or programming languages used in security testing and automation, such as Python or Bash.
* You are technical, curious, and comfortable moving across different security problems instead of specializing in only one area.
* You like to attack systems, but you also enjoy building tools, automations, guardrails, and practical solutions that make security scale.
* You do not need to be an expert in every technology, but you should be able to reason critically, learn fast, use AI effectively, and design pragmatic solutions.
* You have curiosity and willingness to learn about AI security topics such as LLM testing, prompt injection, agentic workflows, data exposure, tool permissions, RAG security, and secure AI adoption.
* Fluency in English is required.
* Будет плюсом: Certifications like BSCP or eWPTX are highly regarded but not mandatory; Experience with Ruby / Ruby on Rails applications is highly regarded, but not mandatory Условия:
* Collaborative, multicultural, and high-growth work environment
* Private health insurance
* Access to gym, pools, and wellness programs
* Savings on expenses
* Language classes
* Office breakfasts and organic fruit
* Exclusive discounts on meals
* Free coffee and tea
* Pet-friendly environment #J-18808-Ljbffr

📌 Offensive security engineer (Comunidad de Madrid)
🏢 Joppy
📍 Comunidad de Madrid