It drives everything we do – from research to client work to community involvement. And it unifies our global team into an elite force with integrity, fierce passion, and relentless creativity that doesn’t just “push the envelope” or “think outside the box.” About IOActive IOActive, a trusted partner for General 1000 enterprises, provides research-fueled security services across all industries. Our cutting-edge cybersecurity teams provide highly specialized technical and programmatic services including full-stack penetration testing, program efficacy assessments, and hardware hacking. IOActive brings a unique attacker’s perspective to every engagement to maximize cybersecurity investments and improve the security posture and operational resiliency of our clients. Founded in 1998, IOActive is headquartered in Seattle with global operations, including state of the art hardware hacking labs in Seattle, WA, Madrid, Spain and Cheltenham, UK. Who You Are The Associate Security Consultant delivers application and infrastructure security services for clients across a variety of industries. Working alongside experienced consultants, this role actively participates in security assessments, web and mobile application reviews, infrastructure penetration tests, and security advisory engagements while developing technical consulting skills. This is an excellent opportunity for someone with a strong interest in cybersecurity who enjoys problem solving, learning new technologies, and working with industry experts to improve software security. You must be in commutable distance to our lab in Madrid as this is an in-office position, but we will consider a hybrid work arrangement for the right candidate.



What You’ll Do Security Assessments Conduct application security assessments for web and mobile applications (Android/iOS), APIs, and other software systems. Conduct infrastructure security reviews Carry out penetration testing activities using both manual techniques and industry-standard security tools. Identify and document security vulnerabilities, misconfigurations and deviations from best practices, providing actionable recommendations to address them. Contribute to client engagements by verifying testing prerequisites are met, collecting information, performing technical testing, and documenting findings. Participate in client meetings and technical discussions alongside senior consultants. Work closely with other consultants on project delivery. Collaborate with software developers, security teams, and project stakeholders from clients across multiple industries. Participate in internal technical trainings. Professional Development Continuously build knowledge of security concepts, tools, and emerging threats. Stay current with security trends, vulnerabilities, and secure development practices. 1-3 years of experience in offensive security services doing web, mobile and infrastructure penetration tests and vulnerability assessments. ~ Good knowledge of common web, mobile,



and infrastructure vulnerabilities as those described in OWASP Top 10 respective projects. ~ Experience with security tools such as Burp Suite, OWASP ZAP, or Tenable Nessus. ~ Understanding of operating systems concepts including Windows and GNU/Linux. ~ Python, Javascript, Bash, PowerShell, C/C++). ~ Knowledge of networking concepts and protocols. ~ Familiarity with security testing methodologies. ~ Experience with cloud security best practices (AWS, Azure, Google) is valued but not required. ~ Internship, academic, Capture the Flag (CTF), open-source, or personal project experience in cybersecurity is valued but not required. ~ Knowledge of secure software development practices is valued but not required. ~ Good written and verbal English communication skills. ~ Bachelor’s degree in computer science, Information Security, Information Technology, Software Engineering, or a related discipline, or equivalent practical experience. ~ Relevant certifications such as OSCP, OSWE, BSCP or similar offensive security trainings are a strong plus. ~ A chance to work with an industry leader in cyber security We're one of “the good guys” doing crazy cool stuff to thwart bad guys in a critically important business, social and political arena. We prohibit discrimination and harassment of any kind based on race, color, sex, religion, sexual orientation, national origin, disability, genetic information, pregnancy, or any other protected characteristic as outlined by federal, state, or local laws. This policy applies to all employment practices within our organization, including hiring, recruiting, promotion, termination, layoff, recall, leave of absence, compensation, benefits, training, and apprenticeship.

📌 Security Associate/Advisor (Madrid)
🏢 IOActive
📍 Madrid