We’re hiring a technical security professional to work across two connected disciplines: penetration testing our portfolio companies’ applications and infrastructure, and M&A Technical Due Diligence on acquisition targets for a private equity firm.
Your first 2-3 months are dedicated to M&A Technical Due Diligence: learning our existing scan and analysis process, running it on real or recent deals, and taking technical ownership of how it’s done — including evaluating new tools and improving methodology over time. You’ll have a Project Manager handling client coordination and report delivery throughout, the same way our pentest engagements work today — your job is the technical analysis and findings, not managing the client relationship.
After that, your time splits. Most weeks you’ll run penetration tests for our portfolio companies. M&A due diligence work is driven by live deal activity, not a calendar — Divoro supports roughly 10-12 engagements a year, unevenly spaced, so some months bring several deals back-to-back and others bring none. When a deal is active, it takes priority over the pentest queue — the rest of the team covers you. Responsibilities:Penetration Testing · Conduct black-box, gray-box penetration tests against web applications, APIs, and network/infrastructure environments
· Identify, exploit, and document vulnerabilities (OWASP Top 10, CIS benchmarks, common infrastructure misconfigurations)
· Write clear, actionable findings reports with risk ratings per CVSS calculator and remediation guidance
· Retest fixes and validate remediation effectiveness M&A Analyst (Static Analysis) · Run Divoro’s M&A Technical Due Diligence scans and analysis on acquisition targets, using tools such as Snyk (OSS/license risk), SonarQube (code quality, technical debt, complexity), and Claude-assisted code analysis — not limited to these; evaluate and propose new tools as the practice’s needs evolve
· Assess code quality, technical debt, complexity, and engineering team signals, and document clear, well-supported findings — the same standard as a pentest report
· Join deal-context intake calls and, when needed, help present findings to deal teams — coordinated by our Project Manager, who owns client communication and report delivery
· Take technical ownership of how the practice evolves — recommend and validate methodology and tooling improvements, with input from the wider team Requirements · 2-4 years of experience in penetration testing
· Strong knowledge of web application and network/infrastructure testing methodologies
· Strong understanding of the software product development cycle and product architecture, sufficient to interpret M&A scan findings independently
· Experience with static analysis tools (e.g., SonarQube, Snyk, Checkmarx)
· Solid understanding of common vulnerability classes and secure coding practices
· Ability to communicate technical risk clearly
· Comfortable working under confidentiality constraints and deal timelines
When applying for this position, please include your salary expectations, current city of residence, and notice period in your cover letter.
