11 hours ago
Milan, ItalySenior
Responsibilities
- Run white-box and black-box penetration tests against internal systems and public-facing applications.
- Manage, triage, and investigate bug bounty submissions and external penetration testing findings.
- Perform variant analysis to identify related vulnerabilities across the codebase and infrastructure.
- Research and assess the security of third-party solutions and integrations.
- Build tooling for reconnaissance, automation, and metrics collection.
- Guide developers, product security teams, and SOC investigations with hands-on offensive security expertise.
- Run demonstrations, workshops, and training to spread offensive security practices.
- Assess Klarna’s technology stack and help mature the security program.
Requirements
- At least five years of experience running penetration tests and technical security assessments against production systems.
- Ability to read code and identify vulnerabilities, particularly in Java and Node.js.
- Experience operating in AWS and reviewing microservice architectures for security gaps.
- Ability to write clear security findings with concrete remediation steps.
- Ability to script tooling in Python.
- Industry certifications such as OSCP, OSWE, CREST, GIAC, or an AWS security certification are advantageous.
- Active participation in CTFs or the broader security research community is advantageous.
- Public security research such as CVEs, conference talks, or published tooling is advantageous.
- Applicants should provide a CV in English.
Benefits
- The role is based in Klarna’s Milan office.
- Most teams currently meet in person two to three days per week, with arrangements varying by team and subject to change.
About Klarna
Klarna is a privately held fintech that provides buy now, pay later financing, checkout, and a consumer shopping app for e-commerce and retail. It monetizes through merchant fees, interchange, and interest and fees on financing, while offering marketing and customer acquisition tools to merchants. Founded in 2005 and headquartered in Stockholm, it operates across Europe and North America.