OUR MISSION UNITES US

"Making the world a safer and more secure place."

It’s our mission, plain and simple. It drives everything we do – from research to client work to community involvement. And it unifies our integral team into an elite force with integrity, fierce passion, and relentless creativity that doesn’t just “push the envelope” or “think outside the box.” We shred the envelope, crush the box, and we have fun doing it. We are always looking for people who share our mission to join us.

About IOActive

IOActive, a trusted partner for Global 1000 enterprises, provides research-fueled security services across all industries. Our cutting-edge cybersecurity teams provide highly specialized technical and programmatic services including full-stack penetration testing, program efficacy assessments, and hardware hacking. IOActive brings a unique attacker’s perspective to every engagement to maximize cybersecurity investments and improve the security posture and operational resiliency of our clients. Founded in 1998, IOActive is headquartered in Seattle with global operations, including state of the art hardware hacking labs in Seattle, WA, Madrid, Spain and Cheltenham, UK.

Who You Are

The Associate Security Consultant delivers application and infrastructure security services for clients across a variety of industries. Working alongside experienced consultants, this role actively participates in security assessments, web and mobile application reviews, infrastructure penetration tests, and security advisory engagements while developing technical consulting skills.

This is an excellent opportunity for someone with a strong interest in cybersecurity who enjoys problem solving,



learning new technologies, and working with industry experts to improve software security. You must be in commutable distance to our lab in Madrid as this is an in-office position, but we will consider a hybrid work arrangement for the right candidate.

What You’ll Do

Security Assessments

- Conduct application security assessments for web and mobile applications (Android/iOS), APIs, and other software systems.
- Conduct infrastructure security reviews
- Where suitable, deliver the above activities with support from more experienced consultants.
- Carry out penetration testing activities using both manual techniques and industry-standard security tools.
- Identify and document security vulnerabilities, misconfigurations and deviations from best practices, providing actionable recommendations to address them.
- Verify and validate remediation actions to confirm fixes applied work as intended.

Client Engagement

- Contribute to client engagements by verifying testing prerequisites are met, collecting information, performing technical testing, and documenting findings.
- Prepare clear, professional reports describing identified risks and recommended remediation steps.
- Participate in client meetings and technical discussions alongside senior consultants.
- Develop an understanding of client environments, technologies,



and business objectives.

Collaboration

- Work closely with other consultants on project delivery.
- Collaborate with software developers, security teams, and project stakeholders from clients across multiple industries.
- Share knowledge and contribute to internal documentation and best practices.
- Participate in internal technical trainings.

Professional Development

- Continuously build knowledge of security concepts, tools, and emerging threats.
- Participate in internal research, lab exercises, and knowledge-sharing sessions.
- Stay current with security trends, vulnerabilities, and secure development practices.
- Support continuous improvement of assessment methodologies and documentation.

What You’ll Bring

- 1-3 years of experience in offensive security services doing web, mobile and infrastructure penetration tests and vulnerability assessments.
- Good knowledge of common web, mobile, and infrastructure vulnerabilities as those described in OWASP Top 10 respective projects.
- Experience with security tools such as Burp Suite, OWASP ZAP, or Tenable Nessus.
- Understanding of operating systems concepts including Windows and GNU/Linux.
- Basic experience with scripting or programming languages (e.g. Python, Javascript, Bash, PowerShell, C/C++).
- Knowledge of networking concepts and protocols.
- Familiarity with security testing methodologies.
- Experience with cloud security best practices (AWS, Azure, Google) is valued but not required.
- Internship, academic, Capture the Flag (CTF), open-source, or personal project experience in cybersecurity is valued but not required.
- Kno

📌 Associate Security Consultant (Madrid)
🏢 IOActive
📍 Madrid