Web & API Penetration Tester
OpenYou will test web applications and APIs across a range of stacks, write findings that developers actually act on, and work alongside our detection team so what you break gets caught next time.
- Home
- Careers
Do the work, then write it up honestly
We are a small team by choice. That means fewer people, more ownership, and no layer of account managers between you and the problem you are solving.
Open roles
Where we are hiring
If your experience does not map neatly onto a listing but you think you would be good at this, write to us anyway and tell us why.
Mobile Security Engineer
OpenYou will reverse Android and iOS builds, test on real devices, and chase findings past the app boundary into the backend APIs behind them. Both platforms, not one.
AI Security Researcher
OpenYou will break LLM applications — prompt injection, retrieval leakage, agent tool abuse — and help build the testing methodology as the field develops. Comfort with ambiguity required.
Detection Engineer
Always interestedYou will build and tune detection content across cloud, identity, endpoint and network telemetry, keep false positives low enough that people still read the alerts, and turn red team findings into coverage.
How we hire
Four steps, no whiteboard theatre
We are not trying to find out whether you can perform under artificial pressure. We are trying to find out whether you would be good to work with on a bad day.
Step 01
A conversation
Thirty minutes with the person you would work alongside. Mostly about what you have actually done and what you want to get better at.
Step 02
A real problem
A short, paid exercise drawn from real work — not a puzzle. You keep your notes and we will walk through our thinking either way.
Step 03
Meet the team
You talk to the people you would sit with. Ask them the awkward questions; that is what the stage is for.
Step 04
An honest answer
A decision within a week, with real feedback whether it is a yes or a no. Nobody enjoys being left hanging.
What you get
Working here
- Remote-first, with hours that fit around your life
- Time and budget for certifications and conferences
- Direct access to clients — no layers in between
- A say in what we take on and how we do it
- Work on offence and defence, not just one
- Honest feedback, including when you are right and we are not
Not seeing your role?
We keep a short list of people we would like to work with before there is a vacancy. If that sounds presumptuous, it is — but it has worked well for us so far.
Think you would fit?
Send us something you have written or built, and tell us what you want to get better at. That tells us more than a CV.