Senior Offensive Security Engineer

At bol, you can make our customers happy by going on the offensive to make the platform safer for customers and partners as a Senior Offensive Security Engineer.

How do you make our customers happy?

By wielding the sharpest digital swords in your arsenal and stealthily hacking away at anything and everything that stands between you and the prize: sneaky, backdoor entry. 😉 Obviously, you do this without nefarious intent, you own an impressive collection of stylish hats, and they’re all #FFFFFF, and you immediately share your methods and findings with the team so appropriate action can be taken and any holes can be closed. In short: you go on the offensive to make the platform safer for customers and partners.

The biggest challenge

As an Ethical Hacker, you use your offensive prowess to attack the platform through penetration testing on request, for example for product teams, and on your own initiative. You prioritize actions based on risk, with high-risk threats taking precedence over lower-risk issues. Your responsibilities include reviewing technical designs and ideas, running “breaking stuff on paper” sessions, performing vulnerability assessments of applications, systems, and networks, and threat modeling to help product teams assess risks in their own solutions. Plus anything and everything else that needs doing, but nobody thought to mention.

What you will do as Senior Offensive Security Engineer

You’ll join the Security Operations team of hackers, defenders, and “if it’s fixable, consider it done” problem solvers. It is a team where red and blue specialists work together as a purple squad to keep the bol.com platform safe and secure.

The team builds and runs security solutions across the entire bol.com landscape, including customer and partner-facing platforms, office solutions, cloud environments, and the logistical ecosystems that keep fulfillment centers humming and parcels moving.

You will work with two direct colleagues and six blue team security engineers. In addition to hacking and engineering, the team is responsible for security incident management, maintaining oversight of bol.com’s overall security position across systems and data, and delivering major security projects.

Why you can make a difference

Because you’re an accomplished ethical hacker and penetration tester with a deep understanding of internet-facing web applications and cloud-native environments. You are as adept at quick assessments as you are at conducting in-depth penetration tests, and you know when each approach works best.

Experience in large engineering-driven environments, where open-source tooling is often preferred, is essential. At bol.com, most solutions are ideated and built in-house, while leveraging existing libraries and frameworks, so that environment should appeal to you.

You are also expected to be available to software engineers when they have security questions and to step up when a security alert breaks the silence. Familiarity with Linux, Tomcat, Java, and Spring microservices is a major asset. In the cloud, bol.com runs native infrastructure on GCP, including Kubernetes.

3 reasons why this is (not) for you

• Your resourcefulness is matched by your initiative: you don’t wait for problems to solve; you find them.
• You are obsessed with details: you spot technical issues and threats that everyone else glosses over.
• You zoom in and out with gusto: you know what’s important when, prioritize like a boss, and naturally focus on the biggest risks first.

Not a fit if

• You are not adept at organizing work in tools like Jira or in Kanban and Scrum-like environments.
• You believe in security by obscurity and are not comfortable explaining threats and issues to product teams in a friendly, respectful, and understandable way.
• You are not approachable or helpful in collaborating with others.

Where you'll be working

At one of the best-known online retail tech platforms in the Netherlands and Belgium. A platform where roughly 13 million customers can choose from around 38 million articles and where about 49,000 commercial partners run their businesses.

Teams work in a multidisciplinary way and aim to enable and empower teams and individuals alike. The guiding principles are job roles over job titles, autonomy, trust, and ownership.

Perks of having a blue heart

• 29 days to recharge
• Travel costs: public transport, car, parking, and charging covered
• Pension plan: 75% premium covered
• Annual bonus: based on sustainability goals