Senior Penetration Tester
L'Oréal
Who Are We?
For 115 years, L’Oréal, the world’s leading beauty player, has devoted itself to one thing only: fulfilling the beauty aspirations of consumers around the world.
For more than a century, L’Oréal has devoted itself solely to one business: Beauty. Present in 150 countries across five continents and with €42 billion consolidated sales, L'Oréal is the global industry leader. With 37 global beauty brands across four divisions, L’Oréal offers beauty for each covering all beauty categories and catering to all beauty desires. With the acquisition of the Australian brand Aēsop in 2023, the Group continues to expand its portfolio through targeted acquisitions as part of its drive to create the future of beauty.
Today, L’Oréal includes more than 2,000 tech professionals and is constantly growing. Beauty Tech is changing the game and leading the shift towards new consumer realities and a digital disruption. Championing Beauty Tech, we invent the beauty of the future while becoming the company of the future.
Beauty Tech is how we know our consumers intimately, augmenting their beauty journeys with unparalleled diverse and sustainable experiences. Beauty Tech equips the Group with the key assets it needs to conquer this new world, where Tech has become strategic. With this ambition, L’Oréal continues to recruit diverse, innovative, skilled and passionate minds in different tech domains such as Data, Digital, Cloud, Cyber Security, IT Architecture, DevOps, Applications and Infrastructure.
A Day in the Life of Regional Senior Penetration Tester !
As a Regional Senior Penetration Tester, you will combine a hacker’s mindset with enterprise-grade execution to secure our regional assets.
In this role, You will..
Be Responsible For The Following
- Team Mentorship: guide and mentor mid-level and junior offensive security engineers. Conduct technical peer reviews of report deliverables, provide career coaching, and help elevate the team's overall technical capability.
- Lead Penetration Testing: Perform rigorous, manual security assessments against L'Oréal’s internal and external assets, including web applications, APIs, mobile apps, network architectures, and cloud environments.
- Lead AI-Driven Innovation: Leverage and integrate cutting-edge Generative AI capabilities to develop, automate, and continuously optimize our offensive workflows, custom exploit tooling, and testing methodologies.
- Vulnerability Management & Triage: perform continuous vulnerability scans, eliminate false positives, and accurately prioritize findings.
- Collaborative Remediation: Evaluate identified security flaws to recommend pragmatic, risk-based remediation strategies (patching, configuration changes, deprecation, or compensating controls).
- Stakeholder Engagement: Run engagement kick-off calls and translate technical vulnerabilities into clear, actionable risks during walkthroughs with application development teams and business stakeholders when needed
- Metrics & Documentation: Draft comprehensive, high-quality technical reports detailing exploit chains, impact analysis, and remediation steps, while reporting key project and operational metrics.
- Education & Experience
- Experience: 8+ years of dedicated, hands-on experience in offensive security, penetration testing, or vulnerability research.
- Education: Bachelor’s degree in computer science, Information Security, Cybersecurity, or equivalent practical field experience.
- Technical Competency & Domain Expertise
- Elite Multi-Domain Exploitation: Advanced, provable experience in:
- Web & API Exploitation: Testing complex web apps and services (REST, GraphQL, microservices), bypassing complex authentication, authorization, and WAF controls in modern web apps and APIs
- Enterprise/Ecommerce solutions: Salesforce (SFCC, SFMC), Shopify, etc.
- Network Infrastructure: Assessing internal/external corporate networks and system configurations.
- Mobile & Client Security: Reverse engineering, dynamic binary analysis, and static analysis of mobile platforms and complex thick client applications.
- Multi-Cloud Penetration Testing: Deep knowledge of exploiting IAM policies, serverless functions, and containerized architectures (Kubernetes/Docker) in Azure, GCP, AWS and Alicloud.
- Active Directory & Network Infrastructure: Designing and executing internal infrastructure compromise pathways (Kerberoasting, AD CS abuse, lateral movement).
- AI-Enabled Pentesting Capability: Proven experience utilizing or building AI-driven security tooling (e.g., leveraging LLMs for automated script generation, secure code review, or creating agentic workflows to augment penetration testing capabilities).
- Advanced Scripting & Exploit Dev: High proficiency in Python, Go, Bash, or PowerShell to develop custom tooling, shellcode, and automated exploit flows.
- Architectural Threat Modeling: Deep understanding of secure design methodologies, threat modeling, and building defensive compensating controls.
- Network & Security Fundamentals: TCP/IP networking, IDS/IPS behaviour, firewalls, Web Application Firewalls (WAF)
- Published CVEs, specialized security research papers, whitepapers, tools on GitHub, or proven history in global CTFs/Bug Bounty platforms
- Communication & Interpersonal Skills
- Language: Fluency in professional-grade English (written and spoken).
- Interpersonal: Outstanding negotiation, diplomacy, and presentation skills. Ability to confidently guide development teams through stressful remediation phases and align stakeholders across multiple cultures.
- Public Contributions: Published CVEs, specialized security research papers, whitepapers, tools on GitHub, or proven history in global CTFs/Bug Bounty platforms.
- Advanced Code Review: Deep experience in manual secure code review across diverse languages (Python, NodeJS, PHP, Java, C#, or Go).
- Advanced Credentials: Holders of specialized certifications such as OSCE, OSWE, OSEE, CREST CRT, or GIAC GXPN.
- Hardware / IoT Security: Experience testing embedded systems, firmware analysis, and radio communication protocols (Bluetooth, NFC, Wi-Fi) for smart consumer devices.
- DevSecOps/AppSec Mastery: Strong experience integrating SAST/DAST and custom offensive testing tools directly into enterprise GitOps/CI-CD pipelines.
- Working with cutting edge Technology, empowering employees with new age learning, global exposure, and opportunities to build future-ready careers.
- A flexible and modern workplace, enabling teams to perform at their best through a smart hybrid model that supports balance and autonomy. A 3 Day in Office, 2 Day Work from Home setup.
- Employee support at every life stage, with inclusive and progressive parental policies that help individuals and families thrive.
- Holistic wellbeing offerings - personalized health benefits and strong mental wellness support to ensure employees feel their best.
- Reward and Recognition opportunities, long-term incentives, and opportunities to share in L’Oréal’s collective success.
- L'Oreal is an Equal Opportunity Employer and takes pride in a diverse environment
- Interview with HR
- Technical Interview
- Interview with the hiring manager
- Business Managerial Interview