Cybersecurity Consultant

Cybersecurity Consultant

Infinum · Zagreb, Croatia (Hybrid) · — · Posted 2026-11-11

Workplace: hybrid

Department: Cybersecurity

Description

We are looking for a detail-oriented Cybersecurity Consultant who is passionate about identifying vulnerabilities, tackling complex security challenges, and helping organizations defend against real-world cyber threats.

We're a team of 30+ people, with the majority based in the UK and the rest in Croatia. Our team plays a critical role in protecting our clients' digital products against potential threats and vulnerabilities. We're now looking to grow our Croatian team for the first time since joining forces with AMR CyberSecurity, a UK-based company specializing in penetration testing and security consulting.

AMR brings an impressive track record, having worked with organizations like Zoom and ISC2 – often in industries where security failures can have consequences far beyond downtime. 

Our team works closely with engineers and system architects to make security an integral part of the software development lifecycle. We work on projects for global clients across industries like finance, hospitality, healthcare, and automotive, testing everything from web and mobile applications to infrastructure, networks, and IoT ecosystems.

Our cybersecurity consultants think like attackers to stay one step ahead. Combining hands-on technical expertise, creative problem-solving, and real-world attack techniques, they utilize a wide range of specialist security tools to uncover vulnerabilities, challenge defenses, and help organizations build resilience against evolving cyber threats

The ideal candidate has a keen eye for detail, up-to-date knowledge of security best practices, and hands-on experience conducting penetration tests as part of client engagements. 

Joining our team is an opportunity to learn from experienced security professionals, exchange knowledge across borders, and contribute to a team tackling some genuinely interesting security challenges.

Your responsibilities

• conduct penetration testing on web & mobile applications to identify security vulnerabilities
• conduct infrastructure and cloud security testing to identify potential weaknesses and misconfigurations
• provide detailed reports of your findings, including risk assessments and remediation recommendations
• collaborate with clients’ teams to help them understand and fix vulnerabilities
• develop and maintain test scripts and custom exploits for use in penetration tests
• stay up to date with the latest attack techniques and tools in order to improve the testing processes and methodologies
• contribute to improving security processes and training team members on security best practices

Requirements

• at least 3 years of experience in web & mobile penetration testing, cloud testing, and application security
• a deep understanding of OWASP standards and guidelines such as the WSTG, ASVS, MASTG, MASVS, and SAMM
• strong communication and interpersonal skills for collaborating with both technical and non-technical stakeholders
• experience with writing penetration testing reports in a clear, concise, and understandable way
• a keen eye for identifying hidden weaknesses that others might overlook, as the smallest vulnerabilities can lead to major breaches
• a strong understanding of the offensive security landscape
• affinity for keeping up with general cybersecurity best practices and news
• comfortable taking ownership of various aspects of a project and being in charge of ensuring everything is delivered on time
• excellent knowledge of written and spoken English
• at least one recognized certification focused on offensive security, e.g., PenTest+, eWPT, eMAPT, OSCP, OSWE, GWAPT, or similar
• willingness to travel occasionally for client meetings, workshops, and on-site engagements

Bonus point

• hands-on experience with penetration testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap)
• familiarity with application security principles and network protocols
• familiarity with cloud security and related attack vectors
• experience in programming or scripting (Python, Bash, etc.) to automate tasks
• familiarity with compliance standards (e.g., ISO 27001, SOC2, PCI-DSS) and their security implications

Benefits

You can read more about the benefits here.

Apply

Apply at Infinum

---

Powered by Workable