D

Devoteam

IT consulting for digital transformation

Senior Technical Security Auditor

Offensive Security & TestingConfirmed live in the last 24 hours
Full-timeLevallois-Perret, FranceNo salary listedIn-person

About the Job

Requirements

  • Demonstrated mastery of penetration-testing approaches and methodologies, including OSSTMM, PTES, and OWASP, and ability to construct realistic, controlled attack scenarios.
  • Ability to analyze security architectures, identify structural weaknesses, and propose pragmatic, prioritized countermeasures.
  • Solid understanding of Active Directory mechanics, including Kerberos, Group Policy Objects, delegations, and attack paths such as ADCS and LAPS where relevant.
  • Understanding of web and API authentication mechanisms, including OAuth2/OIDC, JSON Web Tokens, and single sign-on, as well as access control, segmentation, and application security.
  • Cloud security knowledge for AWS, Azure, or Google Cloud Platform, including identity and access management, networking, storage, managed services, security practices, and exposure risks.
  • Experience using relevant tools such as Burp Suite, Nmap, Metasploit, Nessus, Qualys, OpenVAS, Active Directory tools, fuzzing tools, and cloud and Kubernetes tools, as applicable to the engagement.
  • Scripting and automation skills in Python, Bash, and PowerShell for automation, parsing, proof-of-concept development, and tooling.
  • Ability to produce clear, actionable reports with evidence, severity ratings, recommendations, and action plans, and to present findings to audiences at different levels.
  • Higher education at bac + 5 level through an engineering school or university.
  • Operational English proficiency at B2 level under the Common European Framework of Reference for Languages.
  • Analytical and synthesis abilities, listening skills, and a methodical approach.
  • Ability to work collaboratively and contribute to large-scale projects.

Responsibilities

  • Conduct end-to-end security architecture audits, including design reviews, threat analysis, hardening recommendations, and security patterns.
  • Conduct penetration tests across web, APIs, mobile, internal and external infrastructure, Active Directory, and cloud environments; perform red-team or purple-team activities when appropriate.
  • Define audit scope, rules of engagement, attack scenarios, and test-risk management practices.
  • Write actionable audit reports containing findings, evidence, severity ratings, recommendations, and prioritized remediation plans.
  • Present findings to technical and business stakeholders, track remediation, and perform retesting.
  • Improve practices through playbooks, templates, knowledge sharing, security research, tooling research and development, and community contributions.
  • Perform web and API penetration testing, including assessments of OWASP Top 10 risks, authentication and authorization, business logic, server-side request forgery, cross-site scripting, and injection vulnerabilities.
  • Assess internal and external infrastructure, Active Directory, lateral movement, and privilege escalation.
  • Audit configurations and hardening for operating systems, middleware, Kubernetes, reverse proxies, web application firewalls, and identity and access management.
  • Review cloud identity and access management, exposure, storage, secrets, security posture, and attack scenarios across AWS, Azure, and Google Cloud Platform.
  • Review architecture designs, including flows, trust boundaries, encryption, secrets management, logging, and high availability, and recommend and validate secure-by-design implementation.
  • Coach junior colleagues, review deliverables, and improve working practices and quality.
  • Facilitate workshops for findings presentations, technical awareness, and lessons learned.
  • Coordinate with product, infrastructure, and security teams on prioritization, remediation plans, retesting, and closure.

Desired Qualifications

  • Experience with red-team or purple-team work and attack simulation.
  • Container and Kubernetes security experience, including hardening, role-based access control, admission controls, secrets, and supply-chain security.
  • Relevant certifications such as OSCP, OSWE, OSEP, eJPT, eCPPT, AZ-500, or AWS Security, or equivalent certifications.

About the Company

Devoteam

IT consulting for digital transformation

Devoteam is a consulting firm that helps organizations navigate digital transformation through digital strategy, technology, and cybersecurity services. It offers IT services such as digital business products, data-driven intelligence, business automation, distributed cloud solutions, and cybersecurity to enterprises and public-sector clients. The company operates by delivering consulting services, technology implementation projects, and ongoing managed services, backed by strategic partnerships with AWS, Google Cloud, Microsoft, Salesforce, and ServiceNow. Unlike firms that only provide advisory or tech deployment, Devoteam combines business consulting with creative tech and hands-on solutions across cloud, data, automation, and security. Its goal is to help clients improve operational efficiency and change through technology, guiding them from strategy to execution.

Company size
10,001+
Company stage
IPO
Headquarters
Levallois-Perret, France
Founded
1995

Recently Posted Jobs

Explore more opportunities at Devoteam

See more jobs