Information Security Engineer – Senior Penetration Tester

About the Position

Ryanair Labs is currently recruiting for an Information Security Engineer – Senior Penetration Tester to join Europe’s Largest Airline Group!

This is a very exciting time to join Ryanair as we look to expand our operation to 800 aircraft and 300 million guests within the next 10 years.

Ryanair Labs is the technology brand of Ryanair. Labs is a state of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.

Responsibilities

As a Senior Penetration Tester, you will:

• Find exploitable weaknesses before attackers do across web and mobile applications, APIs, internal networks, identity and multicloud (AWS, GCP, Azure) including the AI-enabled systems we build and buy.
• Maintain an attack-surface inventory (external, internal, cloud, SaaS, AI systems); threat-model with owners; define rules of engagement and safety constraints, especially around operational systems.
• Conduct manual-first testing following recognized methodologies (OWASP WSTG/ASVS/MASVS, PTES, MITRE ATT&CK), with automation for breadth.
• Demonstrate real impact with safe proof-of-concept exploits and attack chains; rate with CVSS plus business context.
• Write remediation owners can act on; pair with engineers; convert findings into detection requirements and control improvements for the detection team.
• Re-test, track closure, measure time-to-remediate and recurrence.
• Test passenger-facing and internal web, mobile and API applications.
• Test internal/external networks, Active Directory / Entra ID and identity attack paths.
• Conduct cloud penetration testing across AWS, GCP and Azure: IAM privilege escalation, misconfigurations, exposed services, CI/CD and secrets.
• Perform AI/LLM application testing: direct and indirect prompt injection, jailbreaks, insecure output handling, excessive agency and tool abuse, RAG data leakage and poisoning, agent/MCP integration weaknesses mapped to OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Run adversary emulation and purple-team exercises with detection engineering.
• Build and maintain tooling and automation; use LLM assistants and agentic coding tools (e.g., Claude Code, OpenCode) for recon automation, PoC development, output parsing and report drafting, validating results and respecting data-handling boundaries.
• Write clear reports and executive summaries; present findings to engineers and leadership.

Requirements

Must have

• 4+ years hands-on penetration testing / offensive security.
• Strong web/API and network/AD testing with manual exploitation, not just scanning.
• Cloud pentesting in at least two of AWS, GCP, Azure, including IAM and identity attack paths.
• Scripting in Python (plus Bash/PowerShell); comfortable reading, modifying and writing exploits and tooling.
• Practical use of MITRE ATT&CK and OWASP methodologies; CVSS and risk-based reporting.
• AI skillset: effective daily use of LLM assistants and agentic coding tools (e.g., Claude Code, OpenCode) with critical validation of output; working knowledge of how LLM applications, RAG pipelines and agents are built and where they break (OWASP LLM Top 10, MITRE ATLAS); ability to design and run structured tests against AI systems.
• Safe testing discipline in production and safety-critical environments; strict rules of engagement.
• Clear written and verbal communication to technical and non-technical stakeholders.

Nice to Have

• Contributions to, or research on, AI red-teaming agents building or extending LLM-driven offensive tooling (autonomous recon, exploitation or prompt-injection agents), automated jailbreak and injection evaluation harnesses, or benchmarks for AI security testing. Open-source commits, publications, conference talks or CTF/AI red-team competition results all count.
• Adversarial ML (evasion, extraction, poisoning) and AI supply-chain risk (models, datasets, dependencies).
• Certifications: OSCP, OSEP, OSWE, GPEN, GWAPT, GCPN, CRTO; cloud security (AZ-500, AWS Security Specialty, Google Professional Cloud Security Engineer).
• Mobile (iOS/Android) and thick-client testing; OT/ICS awareness for airport and ground systems.
• Secure code review and DevSecOps integration (SAST/DAST in CI/CD).
• Public research, CVEs, bug-bounty or open-source tooling contributions beyond AI.

We Offer

Contract of employment (permanent contract after trial period)

• Staff travel benefits from day one
• Multisport card
• Private health care
• Group insurance scheme

Other benefits

• Possibility of taking part in trainings and certifications
• Great chance to meet your colleagues in other offices
• Annual events (i.e. St. Patrick’s Day 🍀)
• Regular social meetings 🍻
• Paid referral system
• New office building surrounded by great dinettes right in the city centre 🌆

About the Company

Ryanair Labs is the technology brand of Ryanair. Labs is a state of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.