Senior Offensive Security Researcher, Baobab

• Proven experience as a Penetration Tester, Offensive Security Engineer, or similar role
• Experience participating in bug bounty programs or CTF competitions
• Strong experience in vulnerability assessment and management, including the triaging and prioritization of findings
• Demonstrable experience in managing, tuning, and improving vulnerability scanning technologies (e.g., Nessus, Qualys, Burp Suite Pro, Acunetix, OpenVAS)
• A keen interest and active involvement in following the bug bounty community, with an understanding of common bug classes and innovative exploitation techniques
• Solid understanding of web application security (OWASP Top 10, etc.), network protocols, operating systems, and cloud security principles
• Experience with scripting languages (e.g., Python, Bash, PowerShell) for automation and tool development
• Strong analytical and problem-solving skills with meticulous attention to detail
• Excellent written and verbal communication skills in English, with the ability to articulate complex technical issues clearly
• A proactive mindset and a passion for continuous learning in the field of offensive security

Desirable

• Triage, analyze, validate, and prioritize vulnerabilities identified through automated scanning tools, manual testing, and external reports
• Continuously improve and optimize our vulnerability scanning technologies and processes, including scanner configuration, custom script development, and integration with other security tools
• Proactively search for critical vulnerabilities on a daily basis across our infrastructure, applications, and services, staying informed about newly disclosed CVEs and emerging threats
• Stay at the forefront of offensive security techniques by actively following and researching methodologies, tools, and exploits shared within the bug bounty community and broader cybersecurity landscape
• Plan, scope, and execute comprehensive penetration tests (e.g., web application, network, API, cloud, mobile) to identify security weaknesses
• Develop and utilize custom scripts, tools, and methodologies to enhance penetration testing efforts and automate attack simulations
• Clearly document and communicate identified vulnerabilities, their potential impact, and actionable remediation recommendations to technical and non-technical stakeholders
• Collaborate with development, operations, and infrastructure teams to provide guidance on vulnerability remediation and secure coding/configuration practices
• Retest and validate the effectiveness of implemented security fixes
• Contribute to the development and refinement of internal security testing methodologies and knowledge base