> Markdown version of [/jobs/ext/3314534-senior-offensive-security-engineer](https://www.wearedevelopers.com/jobs/ext/3314534-senior-offensive-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Offensive Security Engineer

- **Company:** Klarna
- **Location:** London, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), Amazon Web Services, Software System Penetration Testing, White-Box Testing, Python (Programming Language), Node.Js, Integration Frameworks, Vulnerability Analysis, Microservices
- **Published:** September 9, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=894f7765c514cd0b

## About the Role

* You've spent 5+ years running penetration tests and technical security assessments against production systems, not just lab environments.
 * You can read code and find real vulnerabilities in it, particularly in Java and Node.js.
 * You're comfortable operating in AWS and reviewing microservice architectures for security gaps.
 * You write up what you find so developers can act on it - clear findings tied to concrete remediation steps, not just severity labels.
 * You script your own tooling in Python rather than relying only on off-the-shelf scanners.
 * You push offensive security forward at Klarna on your own initiative, not just when assigned a ticket.

Bonus points for

 * Industry certifications such as OSCP, OSWE, CREST, GIAC, or an AWS security certification.
 * Active participation in CTFs or the broader security research community.
 * Public security research you can point to - CVEs, conference talks, or published tooling.

## Description

Klarna runs a public Bug Bounty program and works with external pentest vendors year-round, which means a constant stream of real findings - and someone has to work out which ones matter, why, and what else might be affected by the same root cause. That's this position.

You'll sit on the Offensive Security team, running your own penetration tests against Klarna's internal and public-facing systems while also triaging what comes in from bug hunters, pentest vendors, and the SOC. When you find something, you won't stop at the one instance - you'll dig for variants across the codebase and infrastructure, and take what you learn back to the teams that own the code.

Klarna's stack runs Java and Node.js services on AWS in a microservice architecture, with third-party integrations added constantly - you'll need to keep pace with all of it, not just one corner.

What you'll do

 * You'll run white-box and black-box penetration tests against internal systems and public-facing applications.
 * You'll manage, triage, and investigate Bug Bounty submissions and external pentest findings.
 * You'll perform variant analysis on issues surfaced through any channel, tracing where else the same class of bug might exist.
 * You'll research and assess the security of Klarna's third-party solutions and integrations.
 * You'll build tooling for reconnaissance, automation, and metrics collection.
 * You'll guide developers, product security teams, and SOC investigations with hands-on expertise.
 * You'll run demos, workshops, and training that spread offensive security practices across Klarna.
 * You'll assess the security of Klarna's tech stack and help mature the security program overall.