|
Описание: |
We’re hiring a technical security professional to work across two connected disciplines: penetration testing our portfolio companies’ applications and infrastructure, and M&A Technical Due Diligence on acquisition targets for a private equity firm.
Your first 2-3 months are dedicated to M&A Technical Due Diligence: learning our existing scan and analysis process, running it on real or recent deals, and taking technical ownership of how it’s done — including evaluating new tools and improving methodology over time. You’ll have a Project Manager handling client coordination and report delivery throughout, the same way our pentest engagements work today — your job is the technical analysis and findings, not managing the client relationship.
After that, your time splits. Most weeks you’ll run penetration tests for our portfolio companies. M&A due diligence work is driven by live deal activity, not a calendar — Divoro supports roughly 10-12 engagements a year, unevenly spaced, so some months bring several deals back-to-back and others bring none. When a deal is active, it takes priority over the pentest queue — the rest of the team covers you.
Responsibilities:Penetration Testing
· Conduct black-box, gray-box penetration tests against web applications, APIs, and network/infrastructure environments
· Identify, exploit, and document vulnerabilities (OWASP Top 10, CIS benchmarks, common infrastructure misconfigurations)
· Write clear, actionable findings reports with risk ratings per CVSS calculator and remediation guidance
· Retest fixes and validate remediation effectiveness
M&A Analyst (Static Analysis)
· Run Divoro’s M&A Technical Due Diligence scans and analysis on acquisition targets, using tools such as Snyk (OSS/license risk), SonarQube (code quality, technical debt, complexity), and Claude-assisted code analysis — not limited to these; evaluate and propose new tools as the practice’s needs evolve
· Assess code quality, technical debt, complexity, and engineering team signals, and document clear, well-supported findings — the same standard as a pentest report
· Join deal-context intake calls and, when needed, help present findings to deal teams — coordinated by our Project Manager, who owns client communication and report delivery
· Take technical ownership of how the practice evolves — recommend and validate methodology and tooling improvements, with input from the wider team
Requirements
· 2-4 years of experience in penetration testing
· Strong knowledge of web application and network/infrastructure testing methodologies
· Strong understanding of the software product development cycle and product architecture, sufficient to interpret M&A scan findings independently
· Experience with static analysis tools (e.g., SonarQube, Snyk, Checkmarx)
· Solid understanding of common vulnerability classes and secure coding practices
· Ability to communicate technical risk clearly
· Comfortable working under confidentiality constraints and deal timelines
When applying for this position, please include your salary expectations, current city of residence, and notice period in your cover letter.
Відгукнутись на вакансію |
