About This Role
Understanding how systems work and finding ways to compromise them is at the core of this role. You will help clients and partners uncover security vulnerabilities, understand their impact, and close them. The work involves testing web applications, mobile apps, APIs, cloud infrastructures, and corporate networks, as well as mainframes, IoT, and OT systems, with a focus tailored to your skills and a curiosity for new topics.
Responsibilities
- Plan and conduct penetration tests independently, documenting results according to internal quality standards and established methods, such as OWASP testing guides
- Validate vulnerabilities, investigate realistic attack paths, and derive actionable recommendations
- Write technical reports and management summaries that are useful for both IT teams and decision-makers
- Improve technical and organizational processes and automate recurring tasks
- Share knowledge within the team and support the preparation and execution of OffSec trainings, for example, for OSCP and OSWA preparation
Requirements
- Completed Bachelor's or Master's degree
- At least two years of relevant professional experience
- Ability to work largely independently after an initial training period, recognizing when support is needed and seeking it in a timely manner
- Demonstrated technical curiosity through previous work, personal projects, labs, research, or other practical activities, including the ability to learn unfamiliar systems
- Understanding of why a management summary is more than a list of vulnerabilities and the ability to contextualize technical results comprehensibly
- Experience with scripts and tools that genuinely reduce workload in pentesting
- Team spirit, including sharing knowledge, giving constructive feedback, and valuing professional exchange
- Professional demeanor, communicating clearly, reliably, and at eye level with clients and partners, and taking responsibility for your work and its quality
- Fluent German in spoken and written word
Nice to have:
- Certifications such as OSCP, OSWA, CPTS, or CAPE
Benefits
- Modern home office setup
- Access to OffSec Learn Enterprise, learning materials, and practical training environments
- Support for development towards becoming an OffSec or SANS instructor
- Recognition for own initiative: selected learning activities outside working hours, such as in the PortSwigger Academy, can be rewarded with bonuses or additional leave by arrangement
- Short decision-making paths in a small, specialized company, with direct contact to the owner and the ability to help shape improvements
- Covered costs and time off for jointly selected technical conferences
- Benefits from the OffSec partnership, including access to learning opportunities, cyber ranges, and professional exchange within the partner network
- Company pension scheme
- Company training
- Referral program
- Company mobile phone
- Flexible working hours
- Home office option
Important Details
- Schedule: flexible working hours
About the Company
Exploit Labs helps clients and partners uncover security vulnerabilities, understand their impact, and close them. They test web applications, mobile apps, APIs, cloud infrastructures, and corporate networks, as well as mainframes, IoT, and OT systems.