Senior Offensive Security Specialist

Do you want to challenge and strengthen Avanza’s defense against advanced cyber threats? Do you have deep technical curiosity and a drive to expose critical vulnerabilities before an attacker does? Now is your chance to join our OffSec team! About the Position As a Senior Offensive Security Specialist, you will be a key player in our two-person OffSec team within Avanza’s Cybersecurity department. In this role, you act as our friendly adversary. You dive deep where the stakes are highest - such as complex business logic, transaction flows, and proprietary code - uncovering the logic flaws that automated scanners miss. We work pragmatically and collaboratively. You won't just run tests and hand over a PDF report; you will act as a trusted advisor to our product, engineering, and Blue teams, ensuring risks are genuinely understood and resolved without sacrificing production stability. Your primary responsibilities will include:

• Planning and executing targeted penetration tests, Red Team exercises, and deep code/architecture reviews across our hybrid environments.
• Translating technical vulnerabilities into clear business risk and collaborating directly with engineering teams to design and verify remediations.
• Running joint Purple Team exercises with the Blue Team (CSIRT/SOC) to benchmark and tune our detection capabilities.
• Developing, maintaining, and automating custom testing tools, scripts, and attack infrastructure.
• Managing Avanza’s bug bounty program and triaging external researcher findings.

Who are you? You have an adversarial instinct for spotting subtle logic flaws, paired with the operational maturity needed in a live banking environment. You are persistent and creative when dissecting complex systems, but deliberate enough never to disrupt production. Most of all, you are a consultative team player - you build trust with developers, communicate without finger-pointing, and take personal ownership in driving security initiatives forward. We believe you have:

• 3–5+ years of hands-on experience in penetration testing, Red Teaming, and vulnerability assessments in complex environments.
• Strong proficiency in auditing and understanding complex codebases, preferably Java.
• A solid foundation in modern application stacks, networks, and hybrid infrastructure (cloud and on-premise).
• Strong communication skills in English, with the ability to articulate technical risk to both developers and leadership.

It is a plus if you have:

• Experience from the financial sector, fintech, or other regulated environments.
• Hands-on offensive certifications (e.g., OSCP, OSEP, OSWE, CRTO) or active participation in bug bounty programs.
• Practical experience with Purple Teaming and frameworks like MITRE ATT&CK.
• Software development or scripting experience in Java, Python, JavaScript, or C#.

Application Send your application by clicking the ”Apply” button below. The selection process is ongoing, so please submit your application as soon as possible, but no later than November 29. We look forward to receiving your application! We kindly decline offers from recruitment agencies and advertising sellers.