Job-ID: b06e3cd8-9f42-42a1-a575-d874f6f8c7b9Location: MilanSalary: 72950 - 93142 EURType: Full timePosted: Contact: , briefly At Klarna, were building an everyday finance network, helping over 120 million consumers across 26 countries save time and money, and worry less about their finances. Working here means taking on problems most companies never get to solve, and being hands-on enough that the interesting part of the work lands with you, not someone else — youll build with AI, not watch it happen. This is the stretch zone. Come find out what youre capable of. About the role Klarna runs a public Bug Bounty program and works with external pentest vendors year-round, which means a constant stream of real findings — and someone has to work out which ones matter, why, and what else might be affected by the same root cause. Thats this position. Youll sit on the Offensive Security team, running your own penetration tests against Klarnas internal and public-facing systems while also triaging what comes in from bug hunters, pentest vendors, and the SOC. When you find something, you wont stop at the one instance — youll dig for variants across the codebase and infrastructure, and take what you learn back to the teams that own the code. Klarnas stack runs Java and Node.js services on AWS in a microservice architecture, with third-party integrations added constantly — youll need to keep pace with all of it, not just one corner. What youll do Youll run white-box and black-box penetration tests against internal systems and public-facing applications. Youll manage, triage, and investigate Bug Bounty submissions and external pentest findings. Youll perform variant analysis on issues surfaced through any channel, tracing where else the same class of bug might exist. Youll research and assess the security of Klarnas third-party solutions and integrations.



Youll build tooling for reconnaissance, automation, and metrics collection. Youll guide developers, product security teams, and SOC investigations with hands-on expertise. Youll run demos, workshops, and training that spread offensive security practices across Klarna. Youll assess the security of Klarnas tech stack and help mature the security program overall. Who you are Youve spent 5+ years running penetration tests and technical security assessments against production systems, not just lab environments. You can read code and find real vulnerabilities in it, particularly in Java and Node.js. Youre comfortable operating in AWS and reviewing microservice architectures for security gaps. You write up what you find so developers can act on it — clear findings tied to concrete remediation steps, not just severity labels. You script your own tooling in Python rather than relying only on off-the-shelf scanners. You push offensive security forward at Klarna on your own initiative, not just when assigned a ticket. Premio points for Industry certifications such as OSCP, OSWE, CREST, GIAC, or an AWS security certification. Active participation in CTFs or the broader security research community. Public security research you can point to — CVEs, conference talks, or published tooling. Things you should know before applying This position is based in Klarnas Milan office; most teams currently meet in person 2–3 days per week, and this varies by team and can change over time. Non-obvious backgrounds are welcome. Diversity of skills, perspectives, and backgrounds is how we create, innovate, and disrupt like no other. Final compensation will be based on the candidates qualifications, skills, and experience. Please include a CV in English. Concrete beats comprehensive — what you built, what it did, what it cost. Curious to learn more about Klarna and what its like to work here? Explore our career site!

📌 Senior Offensive Security Engineer (Milano)
🏢 Klarna
📍 Milano