Senior Cybersecurity Penetration Tester (fmdiv.)

As a Senior Penetration Tester you will play a central role in identifying assessing and mitigating security vulnerabilities across our digital ecosystem. You will lead complex technical evaluations spanning modern web applications backend architectures APIs and cloud-native environments helping engineering teams build resilient secure-by-design solutions.

Your contribution to something big:

• Drive Offensive Security: Plan scope and execute comprehensive penetration tests on modern web applications backend microservices REST/GraphQL APIs and cloud-native environments (AWS Azure or GCP).
• Threat Modeling & Architecture Review: Collaborate closely with development and DevOps teams early in the design phase to conduct threat modeling and review architectures ensuring security is baked in from day one.
• Vulnerability Analysis & Exploitation: Perform deep-dive manual and automated vulnerability analyses uncovering complex flaws like business logic bypasses authorization failures and server-side request forgeries.
• Technical Reporting & Remediation Guidance: Author high-quality actionable technical reports that translate complex technical risks into clear business impacts providing pragmatic remediation guidance to our engineering squads.
• Tooling & Innovation: Develop custom testing scripts and explore cutting-edge offensive workflows including integrating AI-assisted security testing and LLM-augmented vulnerability analysis to maximize speed and coverage.

Qualifications :

What distinguishes you: 

Education

• Degree in Computer Science Cybersecurity IT Software Engineering or equivalent practical experience in offensive security.

Experience

• Hands-on experience (ideally 3 years) conducting technical security assessments with a strong focus on web applications APIs and cloud infrastructure.

Know how

• Offensive Security Expertise: In-depth knowledge of backend technologies secure protocols and security standards (e.g. OWASP Top 10 ASVS WSTG OAuth 2.0).
• Cloud & Modern Tech: Solid familiarity with assessing cloud environments (AWS Azure or GCP) IAM configurations container security (Docker Kubernetes) and microservices.
• Tools & Scripting: High proficiency with industry-standard offensive tools (e.g. Burp Suite Pro OWASP ZAP Postman) combined with scripting skills (e.g. Python Bash) to automate testing workflows.

Languages

• Excellent communication skills with fluency in English (written and spoken) to effectively present findings to both technical teams and business stakeholders.

Working Style and Methods

• An analytical and structured problem-solver who enjoys working collaboratively across cross-functional teams to build collective security resilience.

Personality

• A curious continuous learner with a passion for offensive security exploring new technologies and a strong drive to mentor and share knowledge with others.

We also welcome (Preferred / Nice-to-have):

• Enthusiastic interest or experience in AI-driven offensive workflows (e.g. automated payload generation LLM security evaluations).
• Industry certifications such as OSCP OSWE OSCE CRTP GWAPT GPEN or cloud-specific security certifications.
• Experience with source code reviews (SAST) in common modern languages (Java Python Go TypeScript).

Additional Information :

Work #LikeABosch includes: 

Flexible work conditions

Hybrid work system

Exchange with colleagues around the world

Health insurance and medical office on site (general surgeon psychology physiotherapy general clinic)

Training opportunities (p.e. technical training foreign languages training) & certifications

Opportunities for career progression and continuous professional development

Access to great discounts in partnerships and Bosch products

Sports and health related activities

Flexible benefits platform

Free parking lot

Canteen

Success stories dont just happen. They are made...

Make it happen! We are looking forward to your application!

Remote Work :

No

Employment Type :

Full-time