Penetration Tester, Robinhood

• 2–4 years of experience in penetration testing, application security, or security engineering
• Proficiency in reading and reviewing Go and Python source code
• Strong grasp of web application security principles, authentication and authorization models, and common vulnerability patterns
• Experience with vulnerability research, business logic flaws, and application-layer abuse patterns
• Familiarity with Linux systems, intrusion detection, and common log formats
• Hands-on experience testing cloud environments (AWS, GCP, or similar) and container orchestration platforms (Docker, Kubernetes)
• Knowledge of network protocols (TCP/IP, DNS) and secure architecture best practices
• Ability to work independently, structure and execute testing plans, and clearly communicate risk to technical and non-technical stakeholders
• Comfort collaborating and documenting work asynchronously using tools like Slack, GitHub, and JIRA

Desirable

• The Penetration Testing team at Robinhood is a core part of our Offensive Security program and a key pillar within Security & Privacy Engineering
• We work across the company to identify, understand, and reduce security risk through threat modeling, penetration testing, code reviews, and vulnerability research
• Our team goes beyond simply finding issues—we take pride in fixing what we find, contributing to long-term improvements, and proactively helping teams build safer systems from the start
• As a Penetration Tester, you'll be a hands-on contributor to our internal application security testing program
• You'll perform manual assessments, research emerging threats, scale the team with automation, and work directly with engineers to design and implement fixes
• Perform application security assessments, including code reviews (primarily Go and Python), design reviews, and manual penetration testing of web applications, services, and infrastructure
• Conduct threat modeling for high-impact systems and articulate security risk in terms of business logic, fraud potential, and customer impact
• Collaborate on the triage of bug bounty submissions
• Validate critical vulnerabilities surfaced by automated tools and improve detection coverage through scripting and configuration
• Work cross-functionally with engineers to mitigate issues, often contributing detection strategies, and occasionally direct code fixes (via pull requests)
• Research emerging threats, new technologies, and attack techniques to inform internal security guidance and testing approaches
• Publish technical blog posts, speak at industry conferences, or share insights with the wider security community
• Advocate for security and privacy across engineering and product development teams