Ethical Hacker / Pentester

Our requirements

• Foundational penetration-testing experience on Microsoft platforms – you’ve performed security assessments of Windows 10/11 or Windows Server environments and can use common tools (e.g., Nmap, Responder, BloodHound) to spot basic mis­configurations.
• Good understanding of authentication concepts – you know how MFA, Kerberos, and NTLM work at a high level and can explain typical attack paths such as pass-the-hash or credential relays.
• Working knowledge of Active Directory security – you can review group-policy and privilege assignments, map trust relationships, and identify exposures that weaken MFA deployments.
• Familiarity with modern MFA standards – you’ve read specifications or lab-tested solutions that use WebAuthn / FIDO2 passkeys, smartcards, or one-time codes, and understand their basic threat models.
• Comfort with scripting and PoC creation – you can write small PowerShell or Python snippets to automate reconnaissance, parsing logs, or demonstrating a finding.
• Clear written and verbal communication – you translate technical findings into concise, well-structured reports and enjoy explaining risk and remediation steps to engineers and non-technical stakeholders.
• Continuous learner mindset – you track new CVEs, read security blogs, and are eager to dig into fresh attack techniques or defensive best practices.
• Team-oriented approach – you collaborate well in remote, cross-functional groups, ask questions when stuck, and give constructive feedback during peer reviews and debriefs.

Optional

• Hands-on experience testing or administering Azure AD / Entra ID environments.
• Practical exposure to hardware-backed factors (TPM, YubiKey, or Bluetooth LE proximity) in authentication flows.
• Familiarity with red-team frameworks (e.g., MITRE ATT&CK) and basic threat-modeling methodologies.
• Industry certifications such as CompTIA Security+, eJPT, OSCP, or CRTP—proof of commitment to offensive-security skills.
• Previous participation in security communities (CTFs, local meet-ups, or published blog posts/papers).

Your responsibilities

• Research next-generation MFA technologies: Investigate Windows / Windows Server, Active Directory (on-prem & Azure AD), and emerging passwordless standards such as WebAuthn / FIDO2 passkeys, identifying secure integration paths and potential attack surfaces.
• Deep-dive into authentication protocols: Analyze Kerberos, NTLM, OAuth 2.0, and SAML flows to uncover weaknesses, propose hardening strategies, and validate cryptographic soundness.
• Explore hardware-backed security options: Prototype the use of TPM 2.0, security keys (U2F / FIDO2), biometrics, and Bluetooth LE proximity for frictionless, phishing-resistant login experiences.
• Document and communicate findings: Produce clear, risk-ranked reports with reproduction steps, proof-of-concepts, and actionable remediation guidance tailored for product engineering and customer success teams.
• Track emerging threats and bypass techniques: Create internal advisories and threat-model updates that inform roadmap and defensive controls.
• Support incident simulation and response: Lead red-team scenarios and post-test debriefs, helping stakeholders understand impact and prioritize fixes.

About the project

This is how we organize our work

This is how we work on a project

• code review
• architect / technical leader support
• Continuous Deployment
• Continuous Integration
• DevOps
• team-level deployment
• documentation
• issue tracking tools
• functional tests
• integration tests
• pen tests
• performance tests
• test automation
• testing environments
• unit tests
• manual tests

Steps After You Apply

• You’ll be invited to an online meeting with our recruiter
• Afterwards, we’ll ask you to do a small assignment, which will then be discussed with one of our technical leads
• If everything goes well, we will make you an offer and invite you to a final interview

What we offer

• Work on mission-critical security challenges – your findings will directly shape Rublon’s next-generation MFA products and protect millions of users from account takeover.
• Learn from and with high-performing peers – collaborate daily with experienced penetration testers, cryptographers, and software engineers who enjoy sharing knowledge and sharpening each other’s skills.
• Impact without bureaucracy – small, expert teams ship improvements quickly; your recommendations move from report to remediation in weeks, not quarters.

Development opportunities we offer

• industry-specific e-learning platforms
• intracompany training
• space for experimenting
• substantive support from technological leaders
• technical knowledge exchange within the company

Benefits

• private medical care
• remote work opportunities
• flexible working time
• integration events
• no dress code
• coffee / tea

Recruitment stages

• 1.
  online meeting with our recruiter
• 2.
  a small assignment
• 3.
  an offer and invite you to a final interview

RUBLON sp. z o.o.