Offensive Security Engineer (Pentesting & DevSecOps)

About Klar

We're turning one of the world's largest underbanked markets into something fairer, simpler, and more transparent. 7 million users served since 2019. Uber's first global credit card, built right here in Mexico. Klar Empresarial, a brand-new B2B solution bringing agile credit and smart accounts to SMEs who've been ignored by traditional banks for too long.

And a full banking license on the horizon, because our customers asked for it and we listened.

We move fast, we think big, and we go all in, because as our CEO puts it: "Growing doesn't always mean going further. Sometimes it means going deeper." 

Behind all of it is a team of 30+ nationalities, working across Mexico City, Berlin, and Argentina, obsessed with building financial products that are simpler, faster, and fairer than anything that came before.

This is Klar, and we're seeking the people who'll write the next chapter.

Our people

If you join us at Klar, you’ll be welcomed to a team that is rich in many talents and we are very proud! With our head office in Mexico City, and remote tech hubs in Berlin and Argentina, we are always learning something new about another culture or language. With so many people from different backgrounds and walks of life (young professionals, parents, LGBTQ+, neurodivergence), you’ll definitely find your people here! 

Our values

• Ownership - We own our successes & our failures as a team.
• Excellence - We do everything to the best of our ability & always seek to achieve a new level of excellence in our work.
• Inclusion - We believe we are stronger together and actively work to promote a safe, diverse, inclusive, and respectful culture.
• Customer Obsession - We understand the value Klar can bring to its customers & it’s always at the forefront of our decisions.
• Klarity - We communicate clearly & with authenticity. It’s in our name & it’s what we do.
  

About the role

We are looking for a hands-on Offensive Security Engineer who is passionate about breaking things to make them more secure.

In this role, you'll focus primarily on identifying, exploiting, and helping remediate security vulnerabilities across our applications, APIs, and backend services. You'll work closely with engineering teams to understand how our systems operate, uncover complex security weaknesses, and translate your findings into meaningful improvements.

While penetration testing will be at the heart of your responsibilities, you'll also have the opportunity to contribute to our DevSecOps and Application Security practices, helping us build more secure products from the ground up

What you can expect:

• Own end-to-end penetration testing engagements across Klar's web applications, APIs, and backend services, from identifying vulnerabilities to validating remediation.
• Work on complex, real-world security challenges within a fintech environment, helping protect financial products, sensitive customer data, and critical business operations.
• Go beyond automated scanning by conducting in-depth manual security assessments, exploring attack scenarios, and identifying vulnerabilities that automated tools may miss.
• Collaborate closely with engineering teams to explain security findings, assess their potential impact, and help design practical, sustainable remediation solutions.
• Contribute to our security-by-design approach by sharing offensive security insights that help engineering teams identify and prevent vulnerabilities earlier in the development lifecycle.
• Help strengthen our security testing capabilities through automation, improved testing methodologies, and continuous improvements to our security processes.
• Have meaningful ownership and autonomy, with the opportunity to influence security practices, challenge existing approaches, and make a tangible impact on the security of our products.
  

What we are looking for:

• Proven experience performing manual penetration testing on web applications, REST APIs, and backend services.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10.
• Hands-on experience identifying and exploiting authentication, authorization, IDOR/BOLA, SSRF, injection, and business logic vulnerabilities.
• Advanced proficiency with Burp Suite and offensive security tools. Ability to review source code and identify security vulnerabilities.
• Practical knowledge of DevSecOps, CI/CD pipelines, and Secure SDLC practices. Familiarity with SAST, DAST, and SCA security tools.
• Experience with GitHub, GitHub Actions, or similar CI/CD platforms. Scripting and automation skills using Python or Bash.
• Experience collaborating with software engineers to remediate vulnerabilities.

Nice to have:

• AWS and Cloud Security experience. Knowledge of Docker, Kubernetes, and Terraform.
• Experience with Semgrep, Snyk, SonarQube, Checkmarx, or similar tools.
• Participation in Bug Bounty programs, CTF competitions, or vulnerability research. Certifications such as OSCP, OSWE, eWPTX, or equivalent.
• Previous experience in fintech, banking, or financial services.

What we value:

• Strong offensive security mindset and technical curiosity.
• Ability to independently conduct end-to-end penetration testing engagements.
• Experience demonstrating the real-world impact of security vulnerabilities.
• Strong risk assessment and prioritization skills. Effective communication with engineering teams.
• A proactive approach to security automation and continuous improvement. 

Important: Penetration testing is the primary focus of this role. DevSecOps knowledge is a complementary capability, not the main specialization.

Our offer to you:

• Competitive salary based on performance and experience
• Chance of earning Klar stock options
• 26 days of paid vacation per year
• Computer devices
• Sponsored coaching and therapy sessions via Mantra Care
• International work environment with amazing and highly skilled people
• A world class team that helps you evolve your skills in areas you're interested in

Klar is a safe place for everyone!

We trust our highly skilled and diverse team and we’re committed to creating a welcoming and inclusive environment for new talents to flourish. We value diversity and welcome all applications regardless of gender, nationality, ethnic and social origin, religion/belief, physical abilities, age, sexual orientation and identity.

Should you require any accommodations through the recruitment process, please don’t hesitate to let us know how we can help!