Penetration Tester – Applications & Cloud (all genders)

You test applications and cloud environments for vulnerabilities that matter in practice. The focus is on SaaS, APIs, legacy software and PaaS and IaaS environments. You work within agreed written testing boundaries and deliver findings that development and operations teams can use to implement concrete improvements.

For SaaS and APIs, you examine object access, role changes, tokens and business logic. In cloud environments, IAM, exposed services and escalation paths are also relevant. Tool findings are reviewed manually for their impact. A proof of concept stays within the approved scope. The report describes prerequisites, consequences and remediation so developers can reproduce the finding and a retest can verify the fix.

• Agree the testing scope, access, test windows and permitted methods with customers and the project team.
• Perform manual and tool-assisted tests of authentication, authorisation, inputs and relevant cloud configurations.
• Reproduce findings in a controlled manner, assess impact and create meaningful evidence without unnecessarily exposing sensitive data.
• Deliver technical reports, understandable management assessments and actionable countermeasures and support retesting.
• Manually verify and document BOLA/IDOR, authentication and business-logic tests.
• Assess cloud IAM findings for real attack paths and define secure retest criteria.

What matters is demonstrable experience that is relevant to the role. It may come from appropriate vocational training, a degree, professional practice or a well-founded career change. We will align the specific level of responsibility with your knowledge and experience.

• Practical experience with web or API penetration testing and transparent technical findings.
• Understanding of HTTP, authentication, authorisation models and common application vulnerabilities.
• Reliable handling of testing boundaries, confidential data and communication of security-relevant results.

This knowledge is helpful, but you do not need to have all of it at once. In your application, describe where you have already gained practical experience and which areas you would like to explore in greater depth.

• Experience with cloud penetration testing, code reviews or legacy applications.
• Knowledge of AI application security or relevant practical security certifications.

Your work is successful when a finding is reproducible, its impact is understandable and the remediation is verifiable. Outcome-related customer agreements are clarified for each project and do not permit uncontrolled testing or unsupported security promises.

This role can be based in Cologne or performed remotely. We will agree the specific form of collaboration, project requirements and any necessary customer appointments before you start.

This role is offered as permanent employment on a full-time or part-time basis. We will agree the responsibilities, working hours, start date and compensation to suit the role and your level of experience.

Show us in your application which experience or interests you bring to this role. A CV and relevant project examples, certificates or work samples will help us assess your professional background. Please do not send confidential customer data, credentials or protected source code.

Tell us your preferred working model, your possible start date and whether you would like to work full-time or part-time.

If you have questions about the role, contact our recruitment team at hr@otoko.com. Inclusion in the applicant pool is voluntary and takes place only with separate consent; it is not a prerequisite for reviewing your application.