> Markdown version of [/jobs/ext/3044207-penetration-tester-red-team-consultant](https://www.wearedevelopers.com/jobs/ext/3044207-penetration-tester-red-team-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester / Red Team Consultant

- **Company:** Ey Gds Spain - Hybrid
- **Location:** Málaga, Spain
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Software System Penetration Testing, Burp Suite, Linux, Fat Client, Networking Basics, Nmap, Open Web Application Security, Red Team (Cyber Security), Strategies of Testing, Web Applications, Cloud Platform System, Purple Team (Cyber Security), Api Management, Blue Team (Cyber Security)
- **Published:** September 24, 2026
- **Apply:** https://www.adzuna.es/contact-us.html

## About the Role

· Strong understanding of common attack paths and security weaknesses across web, infrastructure, identity, and cloud
· Structured and disciplined working style (documentation, evidence handling, clear communication, and quality focus)
· Ability to translate technical findings into business-relevant risk language and actionable remediation steps
· Client-facing mindset with strong stakeholder management and a proactive, ownership-driven attitude
To qualify for the role, you must have
· 3 - 4 years of hands-on experience in penetration testing and/or red teaming with proven delivery of professional reports
· Solid knowledge of testing methodologies (e.g., OWASP for web/API testing; structured engagement planning and execution)
· Hands-on experience with common offensive security tooling (e.g., Burp Suite, Nmap, scripting for automation/validation)
· Strong understanding of Windows/Linux and networking fundamentals; comfortable with troubleshooting and evidence capture
· English at least B2 - C1 (written and spoken) is required
Ideally, you'll also have
· Relevant certifications (e.g., OSCP/OSWE/GPEN/PNPT or comparable) are a plus
· Experience with specialized testing domains such as cloud pentesting, mobile, thick client, wireless, or social
engineering (depending on engagement model)
· Experience with threat-led red teaming and purple teaming approaches (where applicable)
· German B2
What we look for
We look for ethical attackers who combine technical depth with maturity and discipline-clear scoping, clean
execution, and crisp communication. You care about impact: delivering findings that teams can fix and running
engagements that measurably improve resilience.

## Description

As a member of our team in the EY GDS Spain office in Malaga, you'll have a chance to extend your knowledge & experience by working on interesting projects with the newest technologies and approaches. You'll support clients in choosing the most suitable business solution and take part in digital transformation.
Your key responsibilities
· Plan and execute penetration tests (internal/external), including web applications/APIs,
network/infrastructure, and cloud environments
· Define scope, rules of engagement, and test strategy with stakeholders; ensure safe execution and minimal
operational impact
· Perform security testing using a balanced approach of manual techniques and validated tooling; document
evidence and reproduce findings reliably
· Deliver high-quality reporting (executive summary, technical details, risk rating, remediation guidance);
support retesting and closure
· Conduct (or support) red team / purple team exercises where applicable, aligning scenarios to business risks
and adversary techniques
· Collaborate with defensive teams (SOC/Blue Team/IR) while ensuring appropriate separation and
independence of offensive and defensive activities
· Contribute to continuous improvement: refine methodologies, reusable playbooks/checklists, and
knowledge sharing


## Related Videos

- [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker)
- [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them)
- [Discover the open source trio you didn’t expect: .NET and PostgreSQL on Linux](https://www.wearedevelopers.com/videos/2042-discover-the-open-source-trio-you-didn-t-expect-net-and-postgresql-on-linux)

## Related Articles

- [Where To Find Software Engineering Jobs](https://www.wearedevelopers.com/magazine/396-where-to-find-software-engineering-jobs)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Finding Jobs in Germany](https://www.wearedevelopers.com/magazine/375-finding-jobs-in-germany)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [Finding IT & Technology English-speaking Jobs in Germany ](https://www.wearedevelopers.com/magazine/446-finding-it-technology-english-speaking-jobs-in-germany)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)