Cybersecurity Consultant
WHO WE ARE LOOKING FOR
We are looking for a detail-oriented Cybersecurity Consultant who is passionate about identifying vulnerabilities, tackling complex security challenges, and helping organizations defend against real-world cyber threats.
We’re a team of 30+ people, with the majority based in the UK and the rest in Croatia. Our team plays a critical role in protecting our clients’ digital products against potential threats and vulnerabilities. We’re now looking to grow our Croatian team for the first time since joining forces with AMR CyberSecurity, a UK-based company specializing in penetration testing and security consulting.
AMR brings an impressive track record, having worked with organizations like Zoom and ISC2 – often in industries where security failures can have consequences far beyond downtime.
Our team works closely with engineers and system architects to make security an integral part of the software development lifecycle. We work on projects for global clients across industries like finance, hospitality, healthcare, and automotive, testing everything from web and mobile applications to infrastructure, networks, and IoT ecosystems.
Our cybersecurity consultants think like attackers to stay one step ahead. Combining hands-on technical expertise, creative problem-solving, and real-world attack techniques, they utilize a wide range of specialist security tools to uncover vulnerabilities, challenge defenses, and help organizations build resilience against evolving cyber threats
The ideal candidate has a keen eye for detail, up-to-date knowledge of security best practices, and hands-on experience conducting penetration tests as part of client engagements.
Joining our team is an opportunity to learn from experienced security professionals, exchange knowledge across borders, and contribute to a team tackling some genuinely interesting security challenges.
01
Your responsibilities
- conduct penetration testing on web & mobile applications to identify security vulnerabilities
- conduct infrastructure and cloud security testing to identify potential weaknesses and misconfigurations
- provide detailed reports of your findings, including risk assessments and remediation recommendations
- collaborate with clients’ teams to help them understand and fix vulnerabilities
- develop and maintain test scripts and custom exploits for use in penetration tests
- stay up to date with the latest attack techniques and tools in order to improve the testing processes and methodologies
- contribute to improving security processes and training team members on security best practices
02
Qualifications & experience
- at least 3 years of experience in web & mobile penetration testing, cloud testing, and application security
- a deep understanding of OWASP standards and guidelines such as the WSTG, ASVS, MASTG, MASVS, and SAMM
- strong communication and interpersonal skills for collaborating with both technical and non-technical stakeholders
- experience with writing penetration testing reports in a clear, concise, and understandable way
- a keen eye for identifying hidden weaknesses that others might overlook, as the smallest vulnerabilities can lead to major breaches
- a strong understanding of the offensive security landscape
- affinity for keeping up with general cybersecurity best practices and news
- comfortable taking ownership of various aspects of a project and being in charge of ensuring everything is delivered on time
- excellent knowledge of written and spoken English
- at least one recognized certification focused on offensive security, e.g., PenTest+, eWPT, eMAPT, OSCP, OSWE, GWAPT, or similar
- willingness to travel occasionally for client meetings, workshops, and on-site engagements
Bonus points
- hands-on experience with penetration testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap)
- familiarity with application security principles and network protocols
- familiarity with cloud security and related attack vectors
- experience in programming or scripting (Python, Bash, etc.) to automate tasks
- familiarity with compliance standards (e.g., ISO 27001, SOC2, PCI-DSS) and their security implications
The hiring process, explained
01
Initial call
You talk to the HR person leading you through the selection process. They’ll share more about the role and Infinum, and answer any questions you may have at this stage.
02
First interview
You talk to the Head of the department and an HR person leading you through the selection process. You get to know Infinum, your potential future team, and the position, while we also get to know you.
03
Online testing
You solve a couple of psychological tests that usually include personality tests, logical sequences, and performance and concentration tests, which give us insight into your character, capacities, and aptitudes.
04
Final interview
You talk to the Management and Head of the department, and an HR person. You get a deeper insight into the position and our expectations, while we get the opportunity to ask you more specific questions.
05
Offer
All going well, in this stage we send you the offer, which includes all the information from salary details, vacation days, and all other perks and benefits of working at Infinum
00
Next thing you know
You’ll be turning apps into a digital Fort Knox
Tools
we use
Amass
Amass is our asset discovery tool for mapping out attack surfaces. It helps us gather subdomains, DNS records, and other valuable reconnaissance data.
Burp Suite Professional
Our go-to tool for web application security testing. From manual testing to automated scans, Burp Suite helps us find vulnerabilities and assess risks efficiently.
Frida
Frida is our go-to tool for dynamic instrumentation. It lets us inject scripts into running applications, enabling us to analyze and manipulate app behavior in real-time, often used in reverse engineering and debugging.
Ghidra
Ghidra is essential for reverse engineering software. This open-source suite helps us disassemble and decompile binaries, allowing for in-depth analysis of executable code and uncovering hidden vulnerabilities.
MobSF
We use MobSF for mobile application security assessment. This tool automates static and dynamic analysis, helping us quickly identify security flaws in Android and iOS applications.
Nmap
The network scanner we trust for network discovery and vulnerability assessments. Nmap helps us identify open ports, services, and network misconfigurations.
Nuclei
Our tool of choice for vulnerability scanning with customizable templates. Nuclei helps us automate and scale our reconnaissance efforts.
OWASP ZAP
An open-source web application scanner that’s perfect for quick scans and manual security testing. We rely on ZAP for its simplicity and flexibility in different testing environments.
ReconFTW
A comprehensive reconnaissance tool we use to automate the entire recon process. ReconFTW speeds up data gathering and gives us a detailed overview of our target’s attack surface.
SQLMap
We turn to SQLMap for automating SQL injection testing. It’s a powerful tool that helps us detect and exploit SQL injection vulnerabilities in web applications.
Wireshark
We rely on Wireshark for network traffic analysis. It allows us to capture and inspect data packets in real-time, helping us diagnose network issues and spot potential security threats.
What do we offer?
Feedback and feedforward
Honest communication fuels growth. In our 1 on 1 sessions, 360 reviews, and career progression meetings, we discuss what is great and what could be improved.
Contributing to open source
Sharing is caring doesn’t only apply to chocolate.
Educational budget
We allocate yearly resources for employee education, including books, software, courses, or other learning materials. Big brain energy!
Paid language courses
Paid language courses help our employees master the English language.
Doing a career switch
We don’t have a sorting hat to tell you where you belong, but we will support your career switch from one job position to another.
Traveling on business
Having clients all over the world means our employees sometimes have to travel to and work from beautiful locations.
Subsidized recreation
Stay in shape with a sponsored fitness membership of your choice.
Sponsored health checks
You know the old saying – the greatest wealth is health.
Free power-ups
Snack on fruit, cookies, and nuts to keep your energy levels up.
Car and bike parking
Don’t let it get caught in the rain. We offer free parking for bicycles and subsidized car parking.
Flexible working hours
Tailor your working hours to fit your schedule.
Fun and games budget
Every team gets a monthly budget to hang out and do fun stuff.
