Offensive Security Engineer

About the role

We are looking for an Offensive Security Engineer to join our Technology team. In this hands‑on position you will help protect our data and services by finding and fixing security weaknesses before they can be exploited.

Key responsibilities

• Plan and execute risk‑based security testing of web applications, APIs, infrastructure, networks, identity services and cloud workloads.
• Operate, administer and optimise testing platforms such as SAST, DAST, CSPM and attack‑simulation tools.
• Integrate security testing early in the software development lifecycle and embed controls into code repositories, IDEs and CI/CD pipelines.
• Conduct authorised penetration tests, technical assessments, design reviews and threat‑modelling for major changes.
• Validate, triage and document findings, track remediation, retest and report evidence for audit and governance.
• Use cloud security posture management to assess misconfigurations, attack paths and compliance.
• Perform MITRE ATT&CK‑aligned control validation, adversary emulation and purple‑team activities.
• Provide remediation guidance aligned with OWASP Top 10, PCI DSS and secure AI development practices.

Required profile

• Proven experience in cybersecurity, application security, penetration testing or DevSecOps.
• Strong knowledge of web, API and cloud security concepts.
• Hands‑on experience with security testing tools and automation.
• Ability to work collaboratively with engineering, cloud, platform and architecture teams.

Required skills

• SAST and DAST tools
• Cloud Security Posture Management (CSPM)
• Attack‑simulation tooling
• Web application and API security
• Cloud security and infrastructure hardening
• MITRE ATT&CK framework
• OWASP Top 10 guidelines
• PCI DSS secure coding requirements
• CI/CD pipeline integration
• Vulnerability lifecycle management and remediation tracking