[Hiring] Offensive Security Engineer @Klar Technologies SA de CV SFP

Role Description

We are looking for a hands-on Offensive Security Engineer who is passionate about breaking things to make them more secure. In this role, you'll focus primarily on identifying, exploiting, and helping remediate security vulnerabilities across our applications, APIs, and backend services. You'll work closely with engineering teams to understand how our systems operate, uncover complex security weaknesses, and translate your findings into meaningful improvements.

• Own end-to-end penetration testing engagements across Klar's web applications, APIs, and backend services, from identifying vulnerabilities to validating remediation.
• Work on complex, real-world security challenges within a fintech environment, helping protect financial products, sensitive customer data, and critical business operations.
• Go beyond automated scanning by conducting in-depth manual security assessments, exploring attack scenarios, and identifying vulnerabilities that automated tools may miss.
• Collaborate closely with engineering teams to explain security findings, assess their potential impact, and help design practical, sustainable remediation solutions.
• Contribute to our security-by-design approach by sharing offensive security insights that help engineering teams identify and prevent vulnerabilities earlier in the development lifecycle.
• Help strengthen our security testing capabilities through automation, improved testing methodologies, and continuous improvements to our security processes.
• Have meaningful ownership and autonomy, with the opportunity to influence security practices, challenge existing approaches, and make a tangible impact on the security of our products.

Qualifications

• Proven experience performing manual penetration testing on web applications, REST APIs, and backend services.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10.
• Hands-on experience identifying and exploiting authentication, authorization, IDOR/BOLA, SSRF, injection, and business logic vulnerabilities.
• Advanced proficiency with Burp Suite and offensive security tools.
• Ability to review source code and identify security vulnerabilities.
• Practical knowledge of DevSecOps, CI/CD pipelines, and Secure SDLC practices.
• Familiarity with SAST, DAST, and SCA security tools.
• Experience with GitHub, GitHub Actions, or similar CI/CD platforms.
• Scripting and automation skills using Python or Bash.
• Experience collaborating with software engineers to remediate vulnerabilities.

Requirements

• AWS and Cloud Security experience.
• Knowledge of Docker, Kubernetes, and Terraform.
• Experience with Semgrep, Snyk, SonarQube, Checkmarx, or similar tools.
• Participation in Bug Bounty programs, CTF competitions, or vulnerability research.
• Certifications such as OSCP, OSWE, eWPTX, or equivalent.
• Previous experience in fintech, banking, or financial services.

Benefits

• Competitive salary based on performance and experience.
• Chance of earning Klar stock options.
• 26 days of paid vacation per year.
• Computer devices.
• Sponsored coaching and therapy sessions via Mantra Care.
• International work environment with amazing and highly skilled people.
• A world-class team that helps you evolve your skills in areas you're interested in.

Company Description

Klar is a safe place for everyone! We trust our highly skilled and diverse team and we’re committed to creating a welcoming and inclusive environment for new talents to flourish. We value diversity and welcome all applications regardless of gender, nationality, ethnic and social origin, religion/belief, physical abilities, age, sexual orientation and identity. Should you require any accommodations through the recruitment process, please don’t hesitate to let us know how we can help!