Offensive Security Engineer

• Long-term, stable contract of employment
• Hybrid work from Gdańsk (3 days from the office, 2 remotely)

O naszym kliencie

Acrisure is a global Fintech leader that combines the best of humans and high tech to offer multiple financial products and services to millions of businesses and individual clients. We connect clients to solutions that help them protect and grow what matters, including Insurance, Reinsurance, Cyber Services, Mortgage Origination and more.

Acrisure employs over 17,000 entrepreneurial colleagues in 21 countries and has grown from $38 million to $4.3 billion in revenue in just over ten years. Our culture is defined by entrepreneurial spirit, innovation, client centricity and an indomitable will to win.

Opis stanowiska

Offensive Assessment and Discovery

• Plan and execute authorized, risk-based penetration tests covering web applications, application interfaces, identity flows, business logic and supporting infrastructure.
• Use Kali Linux and equivalent command-line techniques for reconnaissance, enumeration, validation and controlled exploitation.
• Review source code with deterministic tools and AI-driven assessments to locate candidate weaknesses, then manually validate reachability, exploitability and business impact.
• Discover attack chains and control gaps, including authorization failures, injection classes, server-side request weaknesses, insecure object handling, identity abuse and business-logic flaws.
• Build safe, minimal proof-of-concept exploits that demonstrate impact without creating unnecessary operational or data risk.
• Retest remediated issues and provide clear evidence of closure or remaining exposure.

Evidence, Reporting and Collaboration

• Document scope, authorization, methods, assumptions, evidence, reproduction steps, impact and practical remediation recommendations.
• Communicate findings to engineers, security teams, risk stakeholders and leaders at the appropriate level of technical depth.
• Partner with application security and engineering teams to convert recurring offensive findings into durable preventative controls, reusable test cases and secure design patterns.
• Support coordinated testing with internal and external parties while maintaining rules of engagement, confidentiality and auditability.

Capability and Process Development

• Help build a maturing offensive security process, including methodology, rules of engagement, evidence standards, report templates, severity guidance, retest criteria and knowledge repositories.
• Develop and maintain reusable testing utilities and automation that improve coverage, repeatability and efficiency.
• Research emerging attack techniques and responsibly adapt them to the organization's threat model and regulatory constraints.
• Use measurable outcomes such as validated exposure, repeat findings, time to reproduce and retest completion to improve the service.

Profil kandydata

• Deep hands-on experience performing authorized penetration tests against web applications, APIs, authentication and authorization systems, and supporting infrastructure.
• Demonstrated ability to move beyond automated scanner output and manually investigate reachability, exploitability, attack chains and business impact.
• Strong practical experience with Kali Linux and common offensive security tooling, combined with the ability to adapt techniques when standard tooling is insufficient.
• Demonstrated ability to analyze application source code to identify vulnerabilities and use that knowledge to support offensive testing.
• Experience creating safe, minimal proof-of-concept exploits that clearly demonstrate realistic impact without creating unnecessary operational or data risk.
• Strong knowledge of application attack classes, including authorization failures, injection, server-side request forgery, insecure object handling, authentication and identity abuse, and business-logic vulnerabilities.
• Experience producing high-quality penetration-testing reports containing reproducible technical evidence, exploitation details, realistic impact and practical remediation guidance.
• Ability to develop scripts, testing utilities or lightweight tooling that improves assessment effectiveness, repeatability and coverage.
• Strong understanding of rules of engagement, testing authorization, confidentiality and safe handling of evidence during offensive assessments.
• Strong written and verbal English communication, including the ability to explain complex attack paths to engineers, security teams, risk stakeholders and leaders.

Education and Experience

• Typically 5+ years of relevant experience in penetration testing, offensive security, application security or closely related technical security work.
• Demonstrated experience producing proof-of-concept exploits and high-quality technical reports for authorized assessments.
• Experience in financial services or another regulated environment is preferred.
• A recognized hands-on offensive security certification such as OSCP, OSCE3, OSEP, OSWE, GXPN, GWAPT or an equivalent practical certification is strongly preferred. Candidates without such certification should demonstrate comparable practical offensive-security expertise through substantial professional penetration-testing experience.

Working Approach

• Operate as a hands-on individual contributor who collaborates openly, challenges assumptions constructively and follows through on commitments.
• Prioritize safe, authorized and reproducible security work, with clear boundaries and explicit approval before testing.
• Balance regulatory obligations, business risk and engineering velocity, making pragmatic decisions and documenting trade-offs.
• Contribute to an inclusive culture in which colleagues from different countries, backgrounds and disciplines can work effectively together.

Oferujemy

• Permanent employment contract.
• Private healthcare package with Luxmed
• Life insurance with Unum
• MyBenefit cafeteria platform
• Real career growth and learning opportunities within a global organization