The Role

The Offensive Security team is a newly formed team embarking on a mission of rapid maturity and requires a highly motivated and talented Offensive Security Specialist to help guide us on this journey.

The Offensive Security team operates out of Stockholm and is one of the teams responsible for securing Kindred Group and its assets. We are searching for that certain someone who is not satisfied in just knowing common standards and frameworks, but instead likes to understand vulnerabilities, their exploitability, how to think like an adversary, and most importantly how to defend against them. You should have a real personal passion for security (across a broad range of domains), and technology and a desire to develop further as an Offensive Security expert (both technically and generally).

The Offensive Security team is one of three teams (Product Security, Offensive Security and DevSecOps) that make up the larger CyberSecurity team.

What you will be doing

• Own Kindred's internal penetration testing program; coordinate all internal penetration tests and help teams understand and remediate vulnerabilities where necessary
• Help to mature the product/infrastructure security for Kindred's platforms, bringing your expertise to our team to improve the way we work
• Execute penetration tests and red team engagements while maintaining and improving both capabilities
• Work with the team and external stakeholders to maintain and improve the bug bounty program
• Support the team with end-to-end application security reviews 
• Identify security vulnerabilities and develop mitigation plans
• Educate members of the security champion network and security liaisons on secure practices
• Assist the CSIRT team in identifying threats and develop appropriate remediation plans (including forensics and malware analysis/reverse engineering)
• Architect, design, implement, support and evaluate security tools and services
• Develop and interpret security policies and procedures

Your experience

• At least 3 years' experience working in a security related domain (either directly in a security team or focusing on security in, for example, web application security, penetration testing)
• Detailed, hands-on technical knowledge of at least two of: application security, infrastructure security, network security
• Experience in penetration testing and exploitability-focused vulnerability assessment
• Experience in performing red team activities
• Work with security vulnerability assessments and remediation techniques
• Excellent communication skills and strong English, both verbal and written
• Good people skills; able to work both independently and as part of the team
• Able to engage well with technical and non-technical audiences
• Working knowledge of basic scripting (e.g. Python, Bash)
   
• Desirable: Previous experience developing and delivering security software tools
• Desirable: Security experience in service-oriented architectures and web services
• Desirable: Proficiency in threat modelling and risk identification
• Desirable: Knowledge of cloud systems (AWS, Desirable: GCP, Azure)
• Desirable: Development experience (Java, JavaScript)
• Desirable: Relevant university degree
• Desirable: Certifications in: GNFA, GCFE, GPEN, GREM
• Desirable: Offensive Security Certified Professional (OSCP) or Organization for Security and Co-operation in Europe qualifications