(Senior) Penetration Tester & Security Consultant

In this role you perform internal penetration tests and coordinate external security assessments, prioritizing findings by business risk. You’ll validate vulnerabilities, conduct retests, and drive remediation alongside responsible teams. Through Purple Teaming you simulate attacker techniques to strengthen SIEM, EDR, and monitoring controls, while reviewing new systems and threat models before go-live. You collaborate across security and engineering functions to mature our offensive security capabilities and reduce operational risk. This is a chance to shape security at scale within a leading pet-retail group.

• pro rata mobile working
• flexible working hours
• team events
• trainings and seminars in our academy
• dogs welcome in offices
• employee discounts

• Perform internal penetration tests and coordinate external security assessments
• Validate and prioritize vulnerabilities within the Vulnerability Management framework
• Conduct structured retests after remediation to ensure sustainability
• Engage in Purple Teaming to simulate attacker techniques and improve detection/response controls
• Review security for new systems, architectures, and major changes via threat modeling
• Collaborate cross-functionally with Detection & Response, Vulnerability Management, Incident Management, IT, and Engineering
• Drive the development of internal offensive security capability and overall security maturity

• Deep understanding of infrastructure, cloud, and identity security
• Hands-on web and API penetration testing following OWASP
• Proficiency with Burp Suite, Nmap, BloodHound, PingCastle, Git
• Strong scripting skills
• Recognized offensive security certifications (OSCP, PNPT, CRTO, GWAPT) or comparable qualification
• Experience reviewing/testing Linux, Windows, PowerShell, Active Directory
• Experience with German/European regulatory environments (ISO 27001, BSI IT-Grundschutz, TISAX, KRITIS, NIS2) is a strong plus
• Strong documentation and reporting skills
• Fluent German and excellent English

• Cross-functional collaboration
• Clear communication and reporting
• Proactive problem solving
• Infrastructure, cloud and identity security
• Web and API pentesting (OWASP)
• Burp Suite