Offensive Security Engineer - remote job

Sporty Group is hiring a Offensive Security Engineer. The role sits in IT and programming and is fully remote. The company hires candidates based in Europe.

The employer did not publish a figure; that is settled at interview. The advert sets no condition on working hours.

This vacancy passed an automated check: the list excludes any advert requiring a foreign work permit, visa sponsorship, a particular citizenship, or residence in a specific country.

About the Role

In this key position, you'll be essential in fortifying Sporty’s defensive security framework by conducting thorough and proactive vulnerability assessments of our external infrastructure, including virtual private servers (VPS), physical office networks, and endpoint protection systems. As an Offensive Security Engineer, you'll lead comprehensive perimeter security testing, continuous monitoring, and reconnaissance of all Sporty Group external domains, websites, and public IP addresses. You'll collaborate closely with IT, Network Engineering, Security Operations Center (SOC), and Security teams to refine our external security measures, ensuring robust and effective defense mechanisms.

What You'll Be Doing

- External Security Testing: You'll meticulously monitor, map, and test the full extent of Sporty’s external attack surface, encompassing all external domains, subdomains, websites, and public IP addresses. - Adversary Emulation Exercises: Engage in simulated attacks against internal endpoints to verify the efficacy of our Endpoint Detection and Response (EDR) and XDR systems, as well as our SOC monitoring platforms. - Physical and Network Security Audit: Evaluate the security posture of our physical office hardware, network equipment, and internal edge infrastructure. - Web Application and API Testing: Conduct targeted offensive testing on external web applications and public API endpoints. - Defensive Strategy Development: Convert findings from external and network security assessments into actionable defensive strategies, including firewall rules and other protective measures. - Purple Team Collaboration: Work alongside our Purple Team to ensure that our EDR policies, perimeter controls, and firewall rules are functioning as intended. - Exploitation Documentation: Document multi-stage network or system exploitation scenarios to provide detailed remediation guidelines for IT and Security teams. - Vulnerability Support: Assist IT and Network analysts with clear descriptions of vulnerabilities, triage steps, and escalation protocols. - Security Gap Analysis: Track and report on external vulnerability gaps, success rates of emulations, remediation times, asset health, and perimeter exposure trends.

What You'll Bring

- Offensive Security Expertise: Proven experience in offensive security, perimeter penetration testing, and network security assessments. - Discovery and Vulnerability Knowledge: A solid understanding of external asset discovery, DNS configuration vulnerabilities, and public IP network routing. - Technical Proficiency: Practical experience in auditing and testing Linux and Windows environments, as well as underlying network services. - Advanced Emulation Skills: Ability to conduct advanced adversary emulation and bypass techniques against modern EDR and XDR solutions. - Physical Network Testing: Familiarity with testing physical office network hardware, routers, switches, firewalls, and workplace IT systems. - Clear Recommendations: Transform technical risks into clear, actionable recommendations for IT and Security teams. - Web and API Testing: Experience with core web vulnerabilities and limited API interface testing. - Automation Skills: Strong scripting abilities in Python, PowerShell, Bash, or similar tools for perimeter mapping, emulation workflows, and asset discovery. - Tool Proficiency: Knowledge of scanning, reconnaissance, and interception tools, including Kali Linux, Nmap, Shodan, Censys, and others.

Technology Expertise

You should be proficient in any of the following tools and technologies:

- Kali Linux - Nmap - Shodan - Censys - Masscan - Amass - DNS testing tools - Wireshark - Burp Suite - OWASP ZAP - Microsoft Defender XDR - CrowdStrike Falcon - SentinelOne - Atomic Red Team - Caldera - Python - PowerShell - Bash - VPS environments (Linux/Windows Server OS) - Firewalls, Routers - Git, Jira, Confluence

What's in It for You

Sporty is committed to sustainability and offers a remote-first work environment with a competitive salary, individual performance-based bonuses, and 28 days of paid annual leave. Our flexible working hours are 10am-3pm in your local time zone, with additional flexibility outside these hours. We provide top-tier equipment, referral bonuses, and flash bonuses. Additionally, we host annual company retreats that foster global collaboration and connection among our team members.

Interview Process

- Video Screening: Initial review by our Talent Acquisition Team. - Online Assessment: Technical evaluation using Hackerrank. - Video Interview: 60-minute interview with team members. - Final Interview: 60-minute discussion with the hiring manager.

If you're eager to join us, we encourage you to apply. Every application is reviewed by a member of our team, and we aim to respond within 48 hours.