H

Hotmart

Digital product marketplace and creator platform

Cyber Security Analyst - Red Team

Offensive Security & TestingPosted on Nov 11
Full-timeNo salary listedIn-person

About the Job

Requirements

  • Practical experience in offensive security, including penetration testing of web applications and APIs, Red Team work, Bug Bounty, or equivalent activities.
  • Ability to identify and exploit complex vulnerabilities and demonstrate their impact through proof-of-concept work and realistic exploitation scenarios.
  • Solid knowledge of application exploitation techniques, including business-logic, authentication, authorization, and access-control vulnerabilities, as well as chaining failures.
  • Experience with offensive source-code analysis, understanding application behavior, and identifying potential exploitation paths.
  • Ability to develop exploits, proofs of concept, and automation to support offensive security activities.
  • Knowledge of key security risks in AI-based applications, including prompt injection, exposure of sensitive information, and abuse of functionality in LLMs and agents.
  • Familiarity with LLM, RAG, and agent concepts and architectures, and their integrations.
  • Knowledge of security for web applications, APIs, authentication and authorization mechanisms, and inter-service communication.
  • Knowledge of security for CI/CD pipelines, software supply chains, and cloud environments.
  • Familiarity with secure development practices, architecture analysis, threat modeling, and integrating security into the software development lifecycle.
  • Analytical thinking, technical autonomy, communication, and the ability to document findings, explain risks, and collaborate with different teams.

Responsibilities

  • Plan and execute security tests on web applications, APIs, microservices, integrations, and critical platform components.
  • Investigate and exploit complex vulnerabilities by developing attack hypotheses, chaining multiple flaws, and demonstrating their impact through controlled exploitation.
  • Identify business-logic, authentication, authorization, access-control, and other vulnerabilities that could compromise applications and services.
  • Perform offensive white-box source-code analysis, identify exploitation paths, and develop exploits, proofs of concept, and custom solutions as needed.
  • Assess the security of applications based on artificial intelligence, including LLMs, RAG, copilots, and agents.
  • Identify and exploit vulnerabilities such as prompt injection, sensitive-information leakage, response manipulation, functionality abuse, and unauthorized actions.
  • Investigate risks in integrations between AI models, APIs, data sources, and external services, considering potential impacts on applications and corporate information.
  • Assess agent architectures and integrations, contributing to security standards and good practices for AI adoption.
  • Assess CI/CD pipelines, repositories, dependencies, software supply chains, and cloud environments for security issues.
  • Identify and exploit vulnerabilities related to configurations, credentials, permissions, and integrations between platform components.
  • Investigate attack paths that could lead to privilege escalation, lateral movement, or compromise of applications and environments.
  • Participate in development rituals, technical refinements, and architecture discussions with Engineering and Product teams to identify risks early.
  • Perform security analyses and threat modeling, identify potential attack scenarios, and support safer technical decisions.
  • Help ensure products are developed securely from conception by promoting secure-development practices and Secure by Design and Secure by Default principles.
  • Develop automation and solutions to support vulnerability investigation, exploitation, and validation, including the use of artificial intelligence.
  • Analyze and prioritize vulnerabilities based on exploitability, technical context, and actual business impact.
  • Work with responsible teams to define remediation strategies, validate solutions, and prevent vulnerability recurrence.
  • Prepare clear, objective technical reports presenting evidence, exploitation scenarios, identified impacts, and remediation recommendations.
  • Share knowledge and findings with Engineering teams to improve security practices.

Desired Qualifications

  • Relevant offensive security certifications, such as OSWE, OSCP, OSEP, BSCP, or equivalent.
  • Practical experience and dedication to technical development through platforms such as Hack The Box, Hacking Club, TryHackMe, PortSwigger Web Security Academy, Root-Me, or similar platforms.
  • Participation in Capture The Flag competitions, solving practical challenges, or producing technical write-ups.
  • Significant discoveries in Bug Bounty programs, independent security research, reported vulnerabilities, or CVEs.
  • Practical experience assessing the security of AI agents and integrations with external systems.
  • Experience in fintech, payments, marketplaces, or large-scale SaaS platforms.
  • Knowledge of containers, Kubernetes, and Infrastructure as Code.
  • Familiarity with MITRE ATT&CK, MITRE ATLAS, OWASP ASVS, and PCI DSS.
  • Participation in security research, technical publications, talks, or Offensive Security communities.

About the Company

Hotmart

Digital product marketplace and creator platform

Hotmart provides an all-in-one platform for creators to build, host, and sell digital products (courses, ebooks, podcasts, memberships) to buyers worldwide. Creators use built-in tools, secure hosting, multi-currency payments, AI-powered idea generation, and analytics; an expansive affiliate network lets others promote products and earn commissions. Hotmart differentiates itself with a single ecosystem that combines creator tools, affiliate marketing, and international reach, reinforced by acquisitions like Teachable. Its goal is to help people monetize knowledge and passions at scale across many countries.

Company size
10,001+
Company stage
Series C
Total funding
$130.3M
Headquarters
Amsterdam, Netherlands
Founded
2011

Recently Posted Jobs

Explore more opportunities at Hotmart

See more jobs