Penetration Tester

Freelance Application Penetration Testers Freelance contract, 12 months Fully remote in Europe 4 or 5 days per week Interviews next week, start ASAP The Opportunity If you're tired of short engagements that end just as you get to know the application, this one is worth reading. This is a 12-month freelance contract working through a portfolio of around 400 products. That's a full year of booked-in work, with enough variety that no two weeks look the same. The testing follows a structured, prioritised plan, so you're working through a clear schedule rather than firefighting. The Role You'll join an in-house AppSec team as external support, testing both web and desktop applications. Each product is tested black box or grey box, depending on what it needs. Test web applications across the OWASP Top 10, authentication and session management, access control, business logic and REST/SOAP APIs Test thick client applications, including local storage, traffic interception, DLL hijacking, privilege escalation and back-end communication Validate findings manually rather than relying on scanner output Rate vulnerabilities with CVSS and write reports with practical remediation guidance Present findings to product owners and developers, then retest their fixes Because you present directly to the people building the products and retest their fixes, you'll see your findings get resolved rather than sit in a backlog. The Company Our client is a large organisation with a portfolio of around 400 products and a dedicated in-house AppSec team. The team has a clear plan for working through that portfolio and is bringing in experienced freelancers to deliver it. For you, that means a defined scope, a prioritised testing schedule and a team that understands security, so you can get straight into the work. What You'll Need Proven hands-on application penetration testing experience at mid level OSCP, PNPT, BSCP, eCPPT or an equivalent certification Strong Burp Suite skills, plus common tooling such as Nmap, sqlmap, ffuf and Postman A solid understanding of HTTP and authentication protocols including OAuth, SAML and JWT Experience testing thick client / desktop applications Clear, structured report writing in fluent English How to Apply Interviews are taking place next week, so if this sounds right, get in touch now. Send your CV and you'll get feedback as soon as possible. Your CV doesn't need to be up to date. Send what you have, or just give the MAM Gruppe team a call.

Network Security Engineer The Opportunity If you enjoy taking an established firewall estate and leaving it cleaner, leaner and properly documented, this engagement is built for you. This is a temporary role starting in mid-November. Our client is investing in its security function and formalising how security is run, so you'll arrive at the right moment. Decisions get made, changes go live, and the impact of your work will be quick and easy to see. You'll be the go-to person for the Akamai WAF and the firewall rule base. That means clear ownership from day one, not another pair of hands on someone else's backlog. The Role You'll join the security team, working alongside cloud and infrastructure specialists. You'll: Audit the firewall rules end to end, removing anything redundant or broader than it needs to be Document the purpose of every rule that survives the audit Analyse firewall log data to surface problems and guide adjustments Own the Akamai WAF, from setup through to ongoing tuning Shape network security architecture decisions affecting the WAF and cloud platforms Work closely with cloud and infrastructure engineers throughout You'll have the autonomy to run this work your way. What you leave behind is a rule base the team understands and can maintain long after you've gone. What You'll Need Deep, hands-on experience with Akamai WAF, including setup and tuning Experience rationalising firewall rule sets on live production systems The ability to read and interpret firewall log data Professional fluency in German and English Availability to start in mid-November How to Apply If this sounds like your kind of project, we'd like to hear from you. Your CV doesn't need to be up to date. Send what you have, or just give the MAM Gruppe team a call for a confidential conversation.

Lead OT & Information Security Officer The Opportunity If you've spent your career securing operational technology and want to set the standard rather than inherit someone else's, this is worth a look. Our client runs energy storage plants classed as critical infrastructure. They need one person to own cybersecurity across those sites: the architecture, the day-to-day operations and the formal accountability. You won't be advising from the sidelines. You'll be the appointed plant CISO, with your name against compliance and audit readiness and real influence over how sites are designed and run. This is a 3-month contract with potential to extend. You'll be on site 2 days every 2 weeks, which means most of your fortnight is spent away from site. The Role You'll combine hands-on technical design with the formal duties of a site-level Information Security Officer. You'll: Act as appointed plant CISO, leading compliance and audit readiness under NIS2, KRITIS, IEC 62443 and the IT-Sicherheitskatalog (§11 EnWG) Define the standard security architecture every site will follow, including IEC 62443-aligned segmentation, zones and conduits, and secure remote access Run security operations for live plants, covering SOC/SIEM monitoring, incident handling and governance Strengthen incident management, including BSIG and NIS2-aligned escalation and regulatory reporting Carry out plant-level risk assessments and turn the findings into remediation plans Oversee cyber risk and compliance for the entities that operate the assets Advise on security design for large projects still in development That last point matters. You'll shape security on projects before they're built, so the architecture you define becomes the template for what comes next. The Company Our client is a major player in renewable energy, with live plants already operating and a pipeline of large projects in development. Because the sites are critical infrastructure, security isn't a box-ticking exercise here. It sits at the centre of how the plants are built, run and regulated, which gives you the mandate to do the job properly. What You'll Need OT/ICS security experience in energy or other critical infrastructure Experience as an Information Security Officer or CISO Hands-on IEC 62443 experience, particularly zone and conduit design and secure remote access Practical experience of NIS2, KRITIS and the IT-Sicherheitskatalog (§11 EnWG), including audit preparation A track record of risk assessments and remediation roadmaps OT incident response and SOC/SIEM monitoring experience Fluent English How to Apply Interested? Get in touch with the MAM Gruppe team for a confidential conversation about this role. Your CV doesn't need to be up to date. Send what you have, or just give us a call.