Junior Application Security Penetration Tester

100% | Luxembourg

Swiss Post Cybersecurity, a subsidiary of Swiss Post formed in 2024 from the merger of Hacknowledge and terreActive, helps more than 350 organisations across Europe strengthen their cyber resilience from offices in Aarau, Morges, Zurich and Luxembourg.
Join our growing Offensive Security team in Luxembourg, where you will work on real world client engagements, apply modern security frameworks and help shape secure development practices.

What You Will Do

• Conduct hands-on penetration tests and vulnerability assessments of web applications, mobile applications and APIs, including cloud-hosted and AI/LLM enabled features.
• Support the team on other types of engagements (Red Team, internal and external infrastructure, Active Directory, cloud and wireless pentests, phishing campaigns, etc.).
• Contribute to improving Swiss Post Cybersecurity's tools and services (script and tool development, R&D, testing, and setting up new threat identification methods, etc.).
• Technology watch: keep up with emerging threats and attack techniques, as well as evolving security standards and best practices.
• Collaborate with development teams on application architecture reviews and secure code reviews.
• Write clear, reproducible reports with remediation guidance tailored to both technical and management audiences.
• Participate in defining and improving internal pentesting methodologies and tooling.
• Work under the supervision of senior pentesters, progressively leading testing phases and client communication.

What We're Looking For

• 0–2 years of experience in penetration testing or application security.
• Passion for offensive security, curiosity and a strong eagerness to learn (CTFs, Hack The Box, Root-Me, bug bounty or personal labs are a plus).
• Foundational knowledge of web concepts (HTTP, REST/GraphQL APIs, authentication flows such as OAuth 2.0 and OpenID Connect) and coding (JavaScript, Python, Java).
• Hands-on experience with common pentesting tools (Burp Suite, SQLMap, Nmap, ffuf, etc.).
• Understanding of common vulnerabilities (OWASP Top 10, OWASP API Security Top 10, CWE Top 25).
• Solid scripting skills (Python, PowerShell, Bash, etc.).
• Familiarity with frameworks and standards such as OWASP ASVS, OWASP MASVS/MASTG or PTES is a plus.
• Interest in emerging areas such as cloud and AI/LLM application security (OWASP Top 10 for LLM Applications) is a plus.
• Experience with mobile application testing (rooting/jailbreaking devices, Frida, Objection) is a plus.
• Strong logical reasoning, analytical mindset, and problem-solving skills.
• Excellent written and spoken communication skills in French and English; an additional language (German, Luxembourgish, Italian) is a plus.
• Team player, adaptable to fast-paced consulting engagements; occasional travel.

What We Offer

• Competitive salary and benefits (health insurance, meal vouchers, flexible working hours).
• Learning and development allowance for courses and certifications.
• Hybrid working model: office-based with remote flexibility (depending on place of residence).
• Mentorship from senior pentesters and security consultants, and access to the expertise of around 150 colleagues across Switzerland and Luxembourg.
• Participation in security conferences and community events (hack.lu, Black Alps).

Job Details

Employment: 100%, Permanent
Team: Application Security / Offensive Security
Location: Luxembourg (Swiss Post Cybersecurity Lux SA)
Start: As soon as possible, flexible

APCT1_LU