About this job

Do you want to uncover security vulnerabilities in complex open-source software, analyze attack surfaces, and ensure the long-term security of our products? Do you have solid experience in security testing and a passion for automation? Then help us guarantee the long-term security of our Linux-based software solutions.

This position is aimed at experienced talents with sound expertise and relevant professional experience.

Your tasks

Planning and execution of white-box and grey-box penetration tests
Independent identification, analysis and evaluation of security vulnerabilities and potential attack scenarios
Analysis and evaluation of known vulnerabilities (CVEs) regarding their relevance and actual exploitability
Documentation of vulnerabilities, derivation of concrete recommendations for action, and verification of implemented security corrections.
Development and automation of security and regression tests for the sustainable protection of our software
Setting up and maintaining reproducible test environments and integrating automated security checks
Close collaboration with software development in the analysis and remediation of security vulnerabilities.

This is what you bring with you

Studies, training or comparable practical experience in computer science and IT security
Solid practical experience in application security, penetration testing or security research, including the independent identification, analysis and evaluation of security vulnerabilities.
Experience with methods and tools such as vulnerability scanning, dependency scanning, SAST, DAST or fuzzing, as well as the evaluation and interpretation of their results.
Excellent knowledge of the administration and security of Linux systems, as well as the identification and assessment of potential security risks.
Solid knowledge of web application and REST API security, especially in the areas of authentication, authorization, access control and typical web vulnerabilities (e.g. OWASP Top 10)
Experience with automating security tests and audits, for example with GitLab CI/CD, Ansible, OpenTofu or Terraform
An analytical, structured and independent work style, as well as good German and English skills, complete your profile.

Advantageous

We are particularly interested in practical experience with open-source security tools in the areas of penetration testing, code analysis, and vulnerability scanning, such as ZAP, Semgrep, Trivy, or Grype. Knowledge of Ruby on Rails, React, Foreman, or Katello will help you get started, but is not a requirement. We also welcome any previous contributions to open-source projects.

Provided in cooperation with the Federal Employment Agency.

Responsibilities

About this job

This position is aimed at experienced talents with sound expertise and relevant professional experience.

Your tasks

Planning and execution of white-box and grey-box penetration tests
Independent identification, analysis and evaluation of security vulnerabilities and potential attack scenarios
Analysis and evaluation of known vulnerabilities (CVEs) regarding their relevance and actual exploitability
Documentation of vulnerabilities, derivation of concrete recommendations for action, and verification of implemented security corrections.
Development and automation of security and regression tests for the sustainable protection of our software
Setting up and maintaining reproducible test environments and integrating automated security checks
Close collaboration with software development in the analysis and remediation of security vulnerabilities.

This is what you bring with you

Studies, training or comparable practical experience in computer science and IT security
Solid practical experience in application security, penetration testing or security research, including the independent identification, analysis and evaluation of security vulnerabilities.
Experience with methods and tools such as vulnerability scanning, dependency scanning, SAST, DAST or fuzzing, as well as the evaluation and interpretation of their results.
Excellent knowledge of the administration and security of Linux systems, as well as the identification and assessment of potential security risks.
Solid knowledge of web application and REST API security, especially in the areas of authentication, authorization, access control and typical web vulnerabilities (e.g. OWASP Top 10)
Experience with automating security tests and audits, for example with GitLab CI/CD, Ansible, OpenTofu or Terraform
An analytical, structured and independent work style, as well as good German and English skills, complete your profile.

Advantageous

Provided in cooperation with the Federal Employment Agency.