Description
We are looking for a Pentest Service Owner to lead and evolve an enterprise-wide penetration testing service, ensuring effective security assurance across applications, cloud environments, infrastructure, networks, APIs, and identity platforms. In this role, you will act as the bridge between business risk, technical security assurance, and service delivery. You will own the pentesting portfolio, coordinate stakeholders and external providers, prioritize assessments based on risk, and ensure the right testing capabilities are assigned to each engagement. You will also contribute to the evolution of offensive security practices through automation, attack surface management, AI-supported testing, and emerging security technologies.
Responsibilities
•Own and manage the enterprise penetration testing service and portfolio
•Drive risk-based prioritization of pentesting engagements across business and technology domains
•Coordinate internal stakeholders, security teams, and external testing providers to ensure successful delivery of assessments
•Define, review, and challenge testing scopes, methodologies, estimates, assumptions, and engagement objectives
•Ensure the appropriate testing capabilities and expertise are assigned to each assessment
•Translate business risks and technical requirements into meaningful penetration testing objectives
•Oversee service quality, delivery performance, reporting standards, and continuous improvement initiatives
•Review testing outcomes and support stakeholders in understanding risks, findings, and remediation priorities
•Collaborate with cybersecurity teams to enhance offensive security strategies and testing frameworks
•Drive innovation within the service, including automation, attack surface management, AI-supported testing, and emerging offensive security capabilities
•Monitor service effectiveness through metrics, stakeholder feedback, and operational KPIs
•Ensure penetration testing activities are delivered efficiently and aligned with business risk priorities
•Ensure the right testing methodologies and expertise are consistently applied to every engagement
•Provide stakeholders with actionable security insights that improve the organization's security posture
•Ensure external providers operate effectively within defined quality and performance standards
•Continuously evolve the pentesting service through automation, improved processes, and emerging offensive security capabilities
•Ensure security assurance activities provide measurable value and support informed risk-based decision making
Schedule
•08h-17h from Monday to Friday (flexible)
•Full remote
•No office attendance needed; Barcelona location is recommended but not mandatory
Conditions
•Salary package based on your profile
•Ticket restaurant included in-office hours
•Flexible compensation plan (free of income tax) providing medical insurance, public transport ticket, and childcare check
•Discounts in gym network
•Training catalogue
Requirements
•Strong understanding of Application Security, API Security, Cloud Security, Infrastructure Security, Network Security, and Identity Security
•Ability to translate business risks and technical contexts into practical and effective testing objectives
•Strong stakeholder management and communication skills
•Experience managing services, projects, or security-related engagements involving multiple stakeholders
•Ability to challenge testing scopes, methodologies, effort estimations, limitations, and proposed delivery approaches
•Strong analytical and decision-making capabilities
•Professional proficiency in English
•Experience in Penetration Testing, Offensive Security, Red Teaming, or Technical Security Assurance
•Experience coordinating external security vendors and complex security engagements
•Previous hands-on experience in Penetration Testing, Security Engineering, Security Architecture, or Red Team operations
•Familiarity with Attack Surface Management (ASM) solutions and security automation initiatives
•Exposure to AI-assisted security testing and emerging offensive security technologies
•Experience working within large enterprise environments
•Relevant cybersecurity certifications such as OSCP, OSCE, CISSP, CISM, CRTO, CREST, or similar
