> Markdown version of [/jobs/ext/4147988-junior-cybersecurity-engineer](https://www.wearedevelopers.com/jobs/ext/4147988-junior-cybersecurity-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Junior Cybersecurity Engineer - **Company:** Merkl - **Location:** Paris, France - **Experience:** Starter - **Contract:** Internship / Graduate position - **Skills:** Application Programming Interfaces (APIs), User Authentication, Burp Suite, Cloud Computing, Code Review, Cyber Security, Continuous Integration, Linux, Identity and Access Management, Open Web Application Security, Anti-Phishing, Red Team (Cyber Security), Web Application Security, TypeScript, Software Vulnerability Management, Google Cloud, Cloud Platform System, Kubernetes, Solidity, Data Pipelines, Static Application Security Testing, Golang, Dynamic Application Security Testing - **Published:** October 31, 2026 - **Apply:** https://www.studentjob.fr/offre/9238667-junior-cybersecurity-engineer/reaction/nouveaute ## About the Role You're at the beginning of your career in cybersecurity, passionate about breaking (and fixing) things, and eager to grow fast in a fast-paced, innovative environment. We're looking for someone who is: * A fast learner and problem-solver: You are intellectually curious, able to quickly grasp new technologies and concepts, and have a knack for finding innovative solutions to complex technical issues. * Hungry to learn: You're not afraid to ask questions, you welcome feedback, and you spend part of your free time on CTFs, labs, or reading write-ups. * Equipped with an attacker's mindset: You love understanding how things work at a fundamental level, and even more how they can break. You enjoy digging into the technical details of systems. * A great communicator and educator: You know how to explain a vulnerability to an engineer, a founder, or an auditor, and you'd rather teach the team than point fingers. * Driven by data and startup values: You iterate quickly, love testing new ideas (even the most unconventional ones), and are excited to implement them. * Collaborative: You work well in a small, agile team where everyone's contributions are valued., * Excited about the future of finance: You want to protect infrastructure that moves real money. No crypto background needed: you'll learn that side with us., * A first experience in cybersecurity (internship, apprenticeship, or first job), or equivalent hands-on experience through CTFs, home labs, or personal projects. * Solid knowledge of web application security fundamentals (OWASP Top 10, injections, authentication and authorization flaws, SSRF, ...) and hands-on practice with tools like Burp Suite or equivalent. * An interest in bug bounty: you know how programs work (e.g., Immunefi, HackerOne, Cantina, ...), and you may have already reported a few findings yourself. * Curiosity for social engineering and security awareness (phishing simulations, pretexting, ...). * A basic understanding of vulnerability management and its tooling (SAST/DAST/SCA, dependency scanning, ...). * An interest in security audits and compliance frameworks (e.g., SOC 2, ISO 27001): no prior audit experience required, you'll learn it with us. * Good fundamentals in Linux, networking, and cloud environments. Knowledge of Google Cloud Platform (GCP) or Kubernetes is a plus. * Comfort reading and writing code (ideally TypeScript, Golang, Solidity) to understand vulnerabilities, write PoCs, and contribute to fixes. * The willingness to take ownership of your tasks and see them through from start to finish. * Efficiency: Eager to automate every repetitive part of your missions to always move faster and push the boundaries. Bonus: * Experience with smart contract security (Solidity, EVM) or DeFi protocols. * Security certifications such as eJPT, OSCP, or equivalent (or currently preparing one). * Participation in CTFs or public bug bounty findings. * Track record in Root-me or other cyber training platforms. ## Description As a Junior Cybersecurity Engineer at Merkl, you will help protect the systems that move billions of dollars in rewards onchain. With $1.8B+ distributed and millions of users relying on our infrastructure, security is not a feature for us: it is the foundation of the trust our partners place in Merkl. You will work across every team (Engine, Product, Infra) to find weaknesses before attackers do, make sure they get fixed, and continuously raise the security bar of the whole company. You will work closely with our senior engineers and the Infra team, who will support and mentor you as you ramp up. Step by step, you will take ownership of our bug bounty program, challenge our people and processes through internal red team exercises, and become the go-to person for everything related to vulnerability management during our security audits. It's a unique opportunity to learn security hands-on, on real high-stakes systems, with a lot of responsibility early on. Specifically, your responsibilities will include: * Running our bug bounty program: triaging incoming submissions, assessing their severity and real-world impact with the support of senior engineers, communicating with researchers, and owning the associated fix tasks end-to-end until they are shipped and verified. * Running internal, educational pentests (red team): simulating social engineering attacks (phishing, pretexting, ...), stress-testing our development processes (code review, CI/CD, secrets, access management, ...), and attempting various injections and exploits against our applications and APIs. * Turning every finding into a learning opportunity: sharing results with the team in a pedagogical way, running post-mortems and awareness sessions, and helping engineers build a security-first mindset. * Owning evidence in security audits: being responsible for the proofs related to vulnerability management (scanning, triage, remediation SLAs, tracking, reporting, ...) and working with auditors to demonstrate our security posture. * Building and maintaining our vulnerability management process: from detection (SAST/DAST/SCA, dependency scanning, ...) to prioritization, remediation and follow-up. * Collaborating with the Infra and Engine teams to harden our cloud infrastructure, applications, and data pipelines., * Ownership-focused: You take responsibility for your tasks and see projects through to completion, from the first report to the deployed fix.