Penetration Testing (Software & Cloud)

Role Purpose 

The Security Testing Engineer/ Penetration Testing (Software & Cloud) ensures that Landis+Gyr’s EMEA software and cloud-based solutions are secure, compliant, and resilient. This role focuses on identifying, reproducing, and verifying vulnerabilities across SaaS platforms, backend APIs, web applications, and cloud infrastructure, while working closely with DevSecOps and R&D teams to integrate testing into the CI/CD process. 

Key Responsibilities 

• Plan, execute, and document application and cloud security tests, including API, web, and service-level penetration tests. 

• Validate the effectiveness of SAST, DAST, and container scanning in CI/CD pipelines and ensure detected issues are triaged and resolved. 

• Assess authentication, authorization, and session management mechanisms in web and mobile applications. 

• Review cloud configurations and deployments (e.g., GCP, etc.) for compliance with best practices and internal security baselines. 

• Simulate attack scenarios to evaluate resilience of multi-tenant cloud services and identify weak points in integration layers. 

• Work with R&D to define secure deployment and monitoring controls for production environments. 

• Provide remediation guidance to development teams and verify fixes through structured retesting. 

• Support audits and certifications (e.g., CSTAR, ISO 27017, IEC 62443, CRA) with test evidence and reports. 

Required Skills & Experience 

• 4+ years of experience in application or cloud security testing, ideally in SaaS or industrial/energy environments. 

• Deep knowledge of OWASP Top 10, API Security Top 10, and modern cloud security risks. 

• Solid understanding of cloud platforms (e.g., GCP), including IAM, networking, and policy enforcement. 

• Ability to chain low-severity findings into meaningful attack paths