> Markdown version of [/jobs/ext/1413368-team-lead-penetration-testing](https://www.wearedevelopers.com/jobs/ext/1413368-team-lead-penetration-testing). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Team Lead Penetration Testing - **Company:** Búsqueda Avanzada - **Location:** Valencia, Spain - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Amazon Web Services, Business Logic, Software System Penetration Testing, Microsoft Azure, Bash Shell, Burp Suite, Cloud Engineering, Code Review, Cyber Security, Linux, Domain Name System (DNS), Intrusion Detection and Prevention, Python (Programming Language), Network Protocols, Nmap, Open Web Application Security, Windows PowerShell, Security Information and Event Management, TCP/IP, Google Cloud, Cloud Platform System, Software Security, Cyber Threat Analysis, Kubernetes, Metasploit, Cybercrime, Purple Team (Cyber Security), Blue Team (Cyber Security), Docker, Golang - **Published:** July 24, 2026 - **Apply:** https://www.adzuna.es/contact-us.html ## About the Role ️ 5+ years of hands-on experience in Penetration Testing, including web, mobile, API, and cloud environments (AWS, Azure, GCP). ️ Experience building offensive security processes, methodologies, or tools from scratch. ️ Strong "playing coach" mindset: willingness to remain highly hands-on (70-80%) while setting up the function. ️ Deep understanding of penetration testing methodologies and frameworks (OWASP Top 10, SANS Top 25). ️ Demonstrated experience contributing to purple team exercises and working closely with SOC to improve detection logic. ️ Strong hands-on experience with industry-standard tools (Burp Suite Pro, Metasploit, Nmap, etc.) and ability to develop custom automation (Python, Go, PowerShell, Bash). ️ Solid knowledge of network protocols (TCP/IP, HTTP/S, DNS), operating systems (Linux, Windows), and cloud-native architectures (Docker, Kubernetes). ️ Excellent communication skills, with the ability to clearly present critical business risks to both technical and non-technical stakeholders. Nice to Have: ️ Advanced certifications such as OSCP, OSCE, OSWE, CRTP, or SANS GIAC. ️ Experience in fast-growing companies (Gaming/Fintech) with exposure to industry-specific security challenges. We offer excellent benefits, including but not limited to ## Description To lead and grow the Offensive Security function while maintaining a strong hands-on role. Leverage an attacker mindset to identify critical business logic vulnerabilities and attack paths (kill chains), drive collaboration with Application Security and Security Operations teams, and lead purple team activities. Responsibilities: ️ Build the Offensive security function from the ground up: define methodologies, reporting standards, and the hiring plan for future team expansion. ️ Recruit, mentor, and develop the team of offensive security engineers, ensuring technical excellence and consistent delivery quality once hired. ️ Perform deep-dive manual penetration testing for complex, high-risk, or business-critical assets, focusing on realistic attack scenarios rather than high-volume "bug-bounty style" findings. ️ Lead and coordinate purple team exercises with the SOC/Blue Team, simulating real-world attacks to validate detection capabilities and tune SIEM/EDR rules. ️ Collaborate closely with the Application Security Team to validate vulnerabilities and guide effective remediation strategies. ️ Translate offensive findings into actionable threat intelligence, TTPs, and recommendations to enhance detection and threat hunting. ️ Act as a subject matter expert in security architecture discussions, secure design reviews, and security code reviews. ️ Stay current with emerging attack techniques, tools, and security trends, and ensure knowledge is shared within the engineering teams. Areas of Ownership: ️ 0-to-1 establishment of the offensive security capabilities and team roadmap. ️ End-to-end ownership of penetration testing execution, quality, and reporting. ️ Identification of critical attack paths that threaten the company's core business products. ️ Delivery of TTPs and threat-hunting insights for purple team initiatives. ️ Effective cross-team collaboration with Application Security, Security Operations, and Engineering. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Scoring 2000 Products per Request: Performance Pitfalls in Golang](https://www.wearedevelopers.com/videos/2073-scoring-2000-products-per-request-performance-pitfalls-in-golang) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)