Offensive Security Engineer (f/m/d)

Our Cyber Defense team is looking for an Offensive Security Engineer (f/m/d) on a permanent contract based in Lille or Paris.

About the team:

Within Decathlon Digital, our Cyber Defense team protects our global ecosystem daily to make sport sustainably accessible. Composed of passionate experts combining offensive (Red Team) and defensive (Blue Team) visions, Cybersecurity United simulates cyberattacks, detects vulnerabilities, and designs the most advanced detection rules. You will join a dynamic, agile, and collaborative team of about ten people committed to a high-impact international Tech4Good approach.

YOUR FUTURE CONTRIBUTION 

At the heart of technically assessing our resilience, you will simulate attacks to identify vulnerabilities before they are exploited, while supporting business and product teams in securing their assets:

• Application & Network Penetration Testing: Perform in-depth penetration tests on Web applications (OWASP Top 10), APIs (REST/GraphQL), as well as internal infrastructures and Active Directory.

• Cloud Audits & Infrastructure Security: Assess the security of our Cloud environments (AWS, GCP, Azure) and identify misconfigurations as well as privilege escalation paths.

• Adversary Simulation (Red Teaming): Participate in Red Teaming exercises simulating real TTPs (Tactics, Techniques, and Procedures) to test our detection and response capabilities.

• Purple Teaming & SOC Synergy: Collaborate closely with the Blue Team / SOC to validate and enrich detection rules based on your technical findings.

• Reporting, Presentation & Inspirational Role: Write clear audit reports including risk analyses and operational recommendations for technical teams and decision-makers.

WHAT YOU BRING

• Experience: At least 3-4 years of operational experience in offensive security / pentesting.

• Technical Proficiency:

  • Solid skills in Web/API auditing (OWASP vulnerabilities) and Active Directory environments.

  • Knowledge of IAM mechanisms and the security of Cloud services AWS, GCP, Azure (Lambda, S3, Cloud Run...).

  • Practice of scripting and developing custom tools (Python, Go, Bash, or PowerShell).

  • A plus: Experience with C2 frameworks (Sliver, Havoc, Cobalt Strike, Adaptix), EDR/AV bypass, and Maldev, AI for Cyber use cases.

• Interpersonal & Transversal Qualities:

  • Excellent communication skills to simplify complex topics for non-technical stakeholders (Product Owners, management).

  • Team spirit, appetite for knowledge sharing and mentoring.

  • Intellectual curiosity, continuous monitoring of new threats (CVEs, CTFs) and impeccable ethical rigor.

• Languages: Proficiency in technical English (written, read, spoken).

• Certifications (Appreciated): OSCP, OSEP, OSED, CRTO, CRTL, or GRTP.

TECHNICAL STACK

• Pentest / Red Team Tools: Burp Suite Pro, C2 Frameworks (Sliver, Havoc, Adaptix), Metasploit, BloodHound.

• Cloud & Infra Environments: AWS, GCP, Azure, Active Directory / Entra ID, Docker/Kubernetes.

• Languages: Python, Go, Bash, PowerShell.

WHAT WE OFFER YOU

Hybrid work organization;

Equipment provided in accordance with your missions and our societal commitments (Mac or Windows);

A local project team within a global network (possibility of international career);

Skill development and support (diversity of projects, internal and external training, etc.);

Compensation package (employee share ownership, monthly/quarterly bonuses).

OUR COMMITMENT TO INCLUSION AND ACCESSIBILITY

At Decathlon, we recognize the immense value that diversity brings to our teams and we continually strive to foster and cultivate an inclusive and equitable workplace: which is why Inclusion is one of our Human Fundamentals. We encourage people from all backgrounds and abilities to apply, as we are convinced that diversity of thought, culture, identity, and lived experiences makes us stronger.

Decathlon is also committed to providing an inclusive and accessible selection process for all candidates. If accommodations are needed, you can request them via the application form, and your request will be kept confidential. These requests do not affect the outcome of the recruitment process.