> Markdown version of [/jobs/ext/3518961-penetration-tester](https://www.wearedevelopers.com/jobs/ext/3518961-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester

- **Company:** Deloitte
- **Location:** Madrid, Spain (Remote available)
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, Burp Suite, Cloud Testing, Fat Client, Kali Linux, Machine Learning, Nmap, Open Web Application Security, OpenAI, Swagger, Reverse Engineering, Web Applications, Scripting, Postman, Large Language Models, Prompt Engineering, Mitre Att&ck, Generative AI, Metasploit, Ollama, Network Server, Static Application Security Testing, Programming Languages, Dynamic Application Security Testing
- **Published:** October 2, 2026
- **Apply:** https://empleo.es.deloitte.com/talentcommunity/apply/1443217833/?locale=es_ES

## About the Role

* 4+ years of experience in penetration testing, security assessment, or similar roles.
 * Hands-on experience with pentesting platforms and tools (Kali or another dedicated OS; Burp Professional, Nmap, Metasploit, sqlmap, AMASS, etc.).
 * Knowledge of OWASP Top 10 and familiarity with API, thick client, and LLM/AI attack surfaces.
 * Experience with AI models and frameworks (e.g., OpenAI, Anthropic) and tooling (Obsidian, Ollama) is a plus.
 * Scripting skills and working knowledge of at least one programming language and framework.
 * Ability to work with diverse stakeholders and manage concurrent initiatives with good judgement and prioritization.
 * Strong written and verbal communication skills in English; Spanish native or fluent is a plus.

Preferred

 * Certifications: OSCP, CEH, GIAC (GPEN, GSEC, GWAB, GMOB, GCPN) or equivalent.
 * Familiarity with MITRE ATT&CK, SAST/DAST, cloud testing, and reverse engineering.
 * Experience in agentic development and deploying/hosting AI tools (containers, servers, APIs).
 * Experience working in distributed teams and global projects.

## Description

* Execute penetration testing engagements across multiple attack surfaces: web applications, APIs, networks, mobile, thick clients and AI/LLM-based systems.
 * Design and perform automated and manual tests, producing clear, actionable, and prioritized findings for technical and non-technical audiences.
 * Use and adapt testing platforms and tools (e.g., Kali Linux, Burp Suite, Nmap, Metasploit, sqlmap, AMASS, Postman/Swagger).
 * Apply AI and LLM techniques (prompt engineering, agents, emerging frameworks) to accelerate reconnaissance and to generate or refine testing scripts.
 * Develop, maintain, and validate AI-driven agents and tools to automate recurring testing tasks, reducing false positives and improving accuracy.
 * Evaluate and integrate emerging AI-assisted offensive security tools into the team's methodologies and playbooks.
 * Create and maintain technical documentation, methodologies, and standard operating procedures (SOPs).
 * Communicate service capabilities and test results effectively to clients and global stakeholders.