Offensive Security Engineer / Penetration Tester

About Genesis

Genesis is an ecosystem of product IT companies building global innovative products. Products created within the Genesis ecosystem have been downloaded over 1 billion times in total. Genesis is one of Europe's leading tech teams: ranked the best employer by Forbes in 2023 and 2026, and the top IT employer by the DOU community in 2024 and 2025.

About the team and the role

Our Offensive Security Team — part of [TO FILL: name of the ecosystem company / service brand the candidate is joining] — is five engineers delivering penetration testing to external clients, alongside our Application Security, Infrastructure Security and Dark Web Monitoring service lines. You'll own engagements yourself: scoping, testing, reporting and the client conversation that follows, with the Team Lead and fellow engineers reviewing your findings rather than managing your calendar. Demand for our testing services keeps growing, and we're raising the technical bar across all four platforms instead of depending on individual specialists. In your first months you'll deliver client engagements end to end and build our internal methodology for AWS cloud security assessment. Within a year you'll be the team's reference point on at least one platform, and the AI agents you build will be covering the recon and enumeration phases of our tests.

What you'll be doing:

• Deliver end-to-end penetration tests of Web and Mobile applications, Active Directory and cloud environments — from scoping and recon through exploitation and post-exploitation to evidence collection and retest;
• Validate findings from our Application Security and Infrastructure Security services and triage automated scan output: eliminate false positives, confirm exploitability and real business impact, assign accurate risk ratings;
• Write client-facing technical reports in English — reproduction steps, evidence, business-impact framing and practical remediation guidance;
• Communicate directly with clients: kick-off calls, status updates, report walkthroughs, remediation Q&A and retest agreement;
• Build automation and internal tooling that shortens the recon, enumeration and active scanning phases, including AI-agent-based workflows;
• Create and maintain the internal methodology, testing checklists and knowledge base for our Offensive Security service lines;
• Research new attack techniques, evaluate tooling and share what you find with the team.

What we expect from you:

• 2.5+ years of hands-on commercial penetration testing, with several engagements delivered end to end and reports written by you, plus at least one practical certification — OSCP, CPTS, GPEN or CWEE, or a proven equivalent;
• Web application testing to the OWASP Web Security Testing Guide and beyond it: authentication and authorisation flaws, IDOR, injection, SSRF, insecure deserialization and business-logic abuse, with Burp Suite Professional as a daily tool;
• Mobile application testing based on OWASP MASTG for Android and/or iOS: static and dynamic analysis, traffic interception, certificate pinning bypass, insecure local storage, IPC and platform misuse;
• Working knowledge of Active Directory and internal network attacks: enumeration, Kerberos abuse, credential relaying, lateral movement and privilege escalation paths;
• Scripting in Python and/or Bash, and the ability to read application source code and trace vulnerable patterns in at least one of PHP, Java, C#, JS/TS or Python;
• English at B2 or above — enough to run client calls, write structured evidence-based reports and justify a severity rating to a technical client.

Nice to have:

• A second practical certification: BSCP, CWEE, CAPE, GWAPT, OSWE, CRTO, eWPTX or eMAPT;
• Cloud security testing in AWS, Azure or GCP: misconfiguration review, identity and privilege-escalation paths, attacks on managed services;
• Hands-on experience or genuine interest in AI and LLM security — OWASP Top 10 for LLM Applications, prompt injection, agent abuse — and in using AI agents inside offensive workflows;
• Public technical contribution: CVEs, open-source tooling, research write-ups, conference talks, or bug bounty with high-quality reports.

What we offer

• Flexible hours and the option to work from anywhere that suits you;
• Medical insurance;
• 20 paid vacation days per year and unlimited sick leave;
• All the equipment you need for work;
• Compensation for professional training, access to our internal learning platform and lectures;
• Corporate events and networking;
• Free sports training, corporate discounts, and massage when you visit the office;
• Support for colleagues and their families serving in the Defence Forces;
• Support for veterans;
• Assistance in case of harm to health or property caused by the war.

Hiring process

1. Intro call with the recruiter;
2. Interview with the Offensive Security Team Lead;
3. Test task and a walkthrough of your solution;
4. Bar-raising interview;
5. Offer.

Supporting Ukraine 🇺🇦

The Genesis for Ukraine foundation was created in April 2022 in response to the full-scale invasion and the need to act systematically and for the long term. Its focus is supporting Genesis employees and their families in the military, helping the country, and developing educational and veteran projects that support reintegration into civilian life. Its large-scale partnership initiatives include Ukraine's first Veteran Master's Programme, an innovation space with a 3D-printing farm at Kyiv Polytechnic Institute, entrepreneurship training and grant programmes for veterans.

As of early 2026:

• UAH 650+ million — total aid to Ukraine from Genesis and its partners;
• UAH 26+ million — targeted assistance to employees and their families serving in the military.

If this sounds like you, send us your CV along with any public write-ups, CVEs or tooling you'd like us to see. We review every application.