About the Client
Client is one of the key providers of complex meteorological systems deployed at weather services, airports, military bases and private companies. Our company currently has 99 customers and users in around 80 countries all around the globe on all the continents including Antarctica.
About the Role
Our software runs 24/7, processes endless streams of meteorological data, and is relied on by professional meteorologists and aviation operators around the world. Keeping it secure is not an afterthought — it is part of how we design, build, and deliver. As a Software Developer in Security, you will be the person who thinks like an attacker but builds like an engineer: hunting for weaknesses in our products, then helping the team architect the fix and watch the product get safer release after release.
This is a hybrid offensive/defensive role. On the offensive side, you act as our internal penetration tester. On the defensive side, you help shape our Secure Software Development Lifecycle (SSDLC) and DevSecOps practices, consult developers, and build a security culture across the company.
Responsibilities
· Act as our internal ethical hacker — plan and run security tests against our products, manually and with tools such as Qualys, finding vulnerabilities using both AI-assisted and hands-on techniques.
· Contribute to our SSDLC and DevSecOps: security by design, security-focused code reviews, and building security into the pipeline.
· Consult and support developers on security questions, acting as the go-to security expert across teams.
· Run internal security training for developers to raise the whole company's security baseline.
· Help create and maintain security artifacts such as SBOMs.
· When there is no active review queue, turn to proactive work: static analysis and hunting for security problems in the existing/older codebase.
Why this role (and why not "just" an ethical-hacking firm)
If you've done consulting or pentest-shop work, you know the grind: a new client every week, constant context switching, and a thick PDF report at the end that may or may not ever get actioned. This role is different:
· You see it through. Find it, architect the fix, and watch the product actually get safer — instead of handing off a report and moving on.
· Depth over churn. A stable product lifecycle and one codebase to master deeply, rather than shallow engagements that reset every few days.
· Less pressure. No tight external deadlines, no client-facing pressure, and no need to write extensive PDF reports.
· A real team. You are an integrated member of engineering, not an external auditor dropped in for a week.
· Balanced work. Offensive (pentesting) and defensive (SSDLC, tooling, training) — the full spectrum of security work, not just one slice.
Requirements
· A "hacker in your blood" mindset — genuine curiosity about how systems break, and satisfaction in finding the weak spot before anyone else does.
· Ability to read and understand code (primarily C++, Python and TypeScript) well enough to spot security-relevant flaws. You don't need to be a senior C++ developer, but you must be comfortable navigating a real codebase.
· Solid orientation in the application security domain (OWASP Top 10, common vulnerability classes, secure coding principles) and a genuine willingness to keep learning and improving.
· Familiarity with the "security by design" principle and an interest in embedding security into the development process rather than bolting it on afterwards.
· English at least at the C1 level (or very bold B2) — all internal documentation, requirements, and work item descriptions are in English.
· We are only looking for people interested in long-term employment.
Candidate advantages
· Hands-on experience with penetration testing and vulnerability discovery, whether manual or tool-assisted using scanners and pentest tooling (e.g., Qualys, Burp Suite, OWASP ZAP, SAST/DAST tools).
· Using AI-assisted techniques to accelerate vulnerability discovery and code review.
· Experience producing security artifacts such as SBOMs (Software Bill of Materials).
· Integrating security into CI/CD pipelines (DevSecOps) — dependency scanning, SCA, automated security gates.
· Experience with static analysis and auditing older code for latent security issues.
· Security certifications (e.g., OSCP, CEH, or similar) — appreciated, but hands-on skill matters more.
· Knowledge of C/C++ memory-safety issues and/or web application security.
· Experience with cloud technologies and cloud security, especially in Amazon.
· Understanding of cryptography fundamentals.
Nice to Have Skills
n/a