Medior Pentester

Groningen / Hybrid

32-40 hours per week

€ 3.750 - € 4.750

At Zerocopter, we are on a mission to make the digital world a safer place. We help organisations protect themselves by combining smart technology with the skills of some of the best ethical hackers out there. From SaaS security tooling to hands-on testing, we cover a wide range of services - always with a human touch.

We bring our services together under one clear structure, with shared tools, simple processes, and a set of values that guide how we work. We believe in innovation, honesty - and we’re building a team that feels the same way.

We are Zerocopter

We bring together the best hackers in the world in a trusted network, giving you access to ongoing protection: Bug Bounty, Pentesting, Recon, and Coordinated Vulnerability Disclosure - all integrated in one platform.

We’re not here to point fingers. We’re here to help.

Your Role: What You’ll Do

As a Medior Pentester at Zerocopter, you are part of a fast-growing cybersecurity company operating at the intersection of platform-driven security and expert-led testing. You work within our Operations circle, alongside ethical hackers, developers, and assessment leads. This is where execution happens - where real security challenges are solved, and where our promises to clients turn into tangible outcomes.

You independently perform security assessments across applications, APIs, infrastructure and cloud environments, and you triage reports from external researchers on behalf of our clients. In this offensive security role, you also bring depth to the team: guiding junior colleagues, improving how we test, and acting as a point of contact for clients. Your base location is flexible. We work hybrid by default, with regular presence in Groningen for team rhythm and client interaction.

Before you apply

This role requires professional fluency in Dutch. You will also be expected to be present at our Groningen office on a regular basis. Candidates must be based in the Netherlands or the EU and hold the right to work in the Netherlands without sponsorship.

Responsibilities

Performing security assessments across web applications, APIs, mobile, cloud environments (AWS/Azure) and internal infrastructure
Owning assessments end to end, applying and refining structured methodologies such as OWASP and PTES
Writing clear, actionable reports with concrete mitigation recommendations, and leading remediation discussions with clients
Triaging and validating researcher reports in our Bug Bounty and Coordinated Vulnerability Disclosure programs: confirming reproducibility and impact, filtering out duplicates and false positives, and communicating with researchers
Supporting and mentoring junior pentesters
Contributing to the development of tooling, methodology and services
Staying current with emerging threats and attack techniques, participating in research initiatives and sharing knowledge within the team and the wider community

Your Profile

Education & Certifications

2–5 years of experience in offensive security, pentesting or a related field
A completed HBO or WO degree in IT, cybersecurity or a related field
OSCP or CWEE certification (required); OSWE or OSEP is a plus

Skills & experience

In-depth, hands-on knowledge of (cloud) infrastructure, API and web architectures from an offensive perspective
Experience with offensive tooling such as Burp Suite, Nmap, testssl.sh, ffuf, Subfinder and Shodan
Programming/scripting skills (e.g. Python, PowerShell, Bash) to build your own tooling where needed
Experience with Active Directory attacks and privilege escalation
Experience with vulnerability scoring using CVSS 3.1
An adversarial mindset: creative, persistent and able to assess risk holistically across environments
Strong communication skills in both Dutch and English, with the ability to translate technical findings into clear, risk-based recommendations
A combination of ownership, sound judgement and team spirit, and the ability to manage your own engagements in a hybrid setting

Nice to have

Experience with AI/LLM-assisted tools (e.g. Claude Code, Codex, Antigravity CLI) applied to offensive security workflows
Interest or experience in agentic automation: using LLMs or autonomous agents for reconnaissance, vulnerability discovery or exploitation
Active participation in CTFs (e.g. Hack The Box, TryHackMe)

What we offer

Does this feel like a good match?

If so, we’d love to hear from you! Send your CV and a short motivation to menno@zerocopter.com. We review applications as they come in.

Not sure yet? No worries. If you’d like to learn more about the role, the team, or what it’s like to work at Zerocopter, feel free to reach out first - we’ll connect you with one of your future colleagues to help you get a clearer picture.