Offensive Security Engineer (f/m/d)

Our Cyber Defense team is looking for an Offensive Security Engineer (f/m/d) on a permanent contract based in Lille or Paris.

About the team:

Within Decathlon Digital, our Cyber Defense team protects our global ecosystem daily to make sport sustainably accessible. Composed of passionate experts combining offensive (Red Team) and defensive (Blue Team) visions, Cybersecurity United simulates cyberattacks, detects vulnerabilities, and designs the most advanced detection rules. You will join a dynamic, agile, and collaborative team of about ten people committed to a high-impact international Tech4Good approach.

YOUR FUTURE CONTRIBUTION 

At the heart of the technical assessment of our resilience, you will simulate attacks to identify vulnerabilities before they are exploited, while assisting business and product teams in securing their assets:

• Application & Network Penetration Audits: Conduct in-depth penetration tests on Web applications (OWASP Top 10), APIs (REST/GraphQL), as well as internal infrastructures and Active Directory.

• Cloud Audits & Infrastructure Security: Assess the security of our Cloud environments (AWS, GCP, Azure) and identify misconfigurations as well as privilege escalation paths.

• Adversary Simulation (Red Teaming): Participate in Red Teaming exercises simulating real TTPs (Tactics, Techniques, and Procedures) to test our detection and response capabilities.

• Purple Teaming & SOC Synergy: Collaborate closely with the Blue Team / SOC to validate and enrich detection rules based on your technical findings.

• Reporting, Deliverables & Inspirational Role: Write clear audit reports including risk analyses and operational recommendations for technical teams and decision-makers.

WHAT YOU BRING

• Experience: At least 3-4 years of operational experience in offensive security / pentest.

• Technical Proficiency:

  • Solid skills in Web/API auditing (OWASP vulnerabilities) and Active Directory environment.

  • Knowledge of IAM mechanisms and security of Cloud services AWS, GCP, Azure (Lambda, S3, Cloud Run...).

  • Practice of scripting and custom tool development (Python, Go, Bash, or PowerShell).

  • A plus: Experience with C2 frameworks (Sliver, Havoc, Cobalt Strike, Adaptix), EDR/AV evasion, Maldev, and AI for Cyber use cases.

• Interpersonal & Cross-functional Qualities:

  • Excellent communication skills to simplify complex topics for non-technical stakeholders (Product Owners, management).

  • Team spirit, appetite for knowledge sharing and mentoring.

  • Intellectual curiosity, continuous monitoring of new threats (CVEs, CTFs) and impeccable ethical rigor.

• Languages: Proficiency in technical English (written, read, spoken).

• Certifications (Appreciated): OSCP, OSEP, OSED, CRTO, CRTL, or GRTP.

TECHNICAL STACK

• Pentest / Red Team Tooling: Burp Suite Pro, C2 Frameworks (Sliver, Havoc, Adaptix), Metasploit, BloodHound.

• Cloud & Infra Environments: AWS, GCP, Azure, Active Directory / Entra ID, Docker/Kubernetes.

• Languages: Python, Go, Bash, PowerShell.

WHAT WE OFFER YOU

Hybrid work organization;

Equipment provided in accordance with your missions and our societal commitments (Mac or Windows);

A local project team within a global network (possibility of international career);

Skills development and support (diversity of projects, internal and external training, etc.);

Compensation package (employee stock ownership, monthly/quarterly bonuses).

OUR COMMITMENT TO INCLUSION AND ACCESSIBILITY

At Decathlon, we recognize the immense value that diversity brings to our teams, and we continuously strive to foster and cultivate an inclusive and equitable workplace: this is why Inclusion is one of our Human Fundamentals. We encourage people from all backgrounds and abilities to apply, as we are convinced that diversity of thoughts, cultures, identities, and lived experiences makes us stronger.

Decathlon is also committed to providing an inclusive and accessible selection process for all candidates. If you require any accommodations, you can request them via the application form, and this request will be kept confidential. These requests will not affect the outcome of the recruitment process.