Penetration Tester / Red Teamer (Junior)

About Us

Data Oriented Defence Operations (DODO OÜ) is a cutting-edge Cybersecurity boutique based in Tallinn, Estonia. We operate at the forefront of the Deep Tech industry, and yes, it's time to say it openly: we proudly emerged from the NATO ecosystem. We specialize in advanced Defence and Security solutions, pushing the boundaries of what is possible in autonomous offensive security.

The Role

We are looking for a Penetration Tester / Red Teamer to join us as the offensive-security backbone of ARES

, our autonomous red-teaming platform powered by Agentic AI.

This is not a classic pentest role. Your job is to be the 

human red teamer that ARES has to measure up to

. You will build the environments ARES attacks, run engagements against those same targets yourself, and compare what you found against what the AI found — then feed that gap back to the engineering team as concrete product improvements. In practice you are equal parts operator and QA: you break things, and you make the machine better at breaking things.

This is a 

part-time position of approximately 20 hours per week

, fully remote, with flexible scheduling — designed to be compatible with a Master's program or other ongoing commitments.

Eligibility

Given the nature of our work in the Defence and Security sector, this role requires EU/EEA citizenship and residency in Europe

. We appreciate the interest of candidates outside these criteria, but unfortunately we cannot move forward with those applications at this stage.

Compensation & Company Stage — Please Read Carefully

We want to be completely transparent about where DODO stands today, so you can make an informed decision.

We are pre-funding and currently working to close our first investment round. Concretely:

• The role begins with a 

  4-month trial period, which is unpaid

  . During this period we are not in a position to provide either salary or equity.

• If the funding round closes

  , the role converts to a 

  paid position with stock options

  , on terms set out in the Memorandum of Understanding we sign at the outset.

• If the round does not close

  , we will not be able to offer either. We would rather say this openly now than have you discover it in four months.

We understand this is a significant ask, and it will not be the right fit for everyone — that's entirely reasonable. The ~20h/week structure is intended to make it workable alongside studies or other work. If it's not your situation right now, we genuinely understand, and we'd welcome hearing from you again once we're funded.

What You Will Do

1. Target & Range Engineering:

    Design and build deliberately vulnerable environments — web applications, APIs, cloud misconfigurations, Active Directory labs, container escapes — that serve as ARES' training and testing ground.

2. Adversarial QA:

    Manually attack those same targets and benchmark your results against ARES' autonomous runs. Where the AI missed a path, stalled, or produced a false positive, you document why.

3. Attack Path Definition:

    Translate real-world TTPs (mapped to MITRE ATT&CK) into scenarios and success criteria the platform can be evaluated against.

4. Product Feedback Loop:

    Work directly with the Agentic AI team to turn operational findings into concrete backlog items — better tooling, better reasoning, better reporting.

5. Reporting & Validation:

    Assess the quality of ARES' output — are the findings accurate, reproducible, and written the way a client would need to read them?

6. Automation:

    Script target deployment and test scenarios (Python, Bash, Docker) so environments can be spun up repeatably during QA and UAT cycles.

7. Cross-functional Bridging:

    Act as the operational security voice inside an AI engineering team.

What We Are Looking For

1. Hands-on offensive security experience

    — internships, professional engagements, CTFs, bug bounty, or a serious home lab. You can walk us through an attack chain you executed end to end.

2. Web and network penetration testing fundamentals:

    OWASP Top 10, authentication and authorization flaws, injection, SSRF, privilege escalation, lateral movement.

3. Practical command of the standard toolkit:

    Burp Suite, Nmap, Metasploit, Impacket, BloodHound, or equivalents — and an understanding of what they do under the hood.

4. Scripting ability in Python and Bash

    — enough to automate a target build, not just run other people's tools.

5. Comfort with Linux, containers, and cloud environments

    (Docker, and at least one major cloud provider).

6. Familiarity with MITRE ATT&CK

    and structured thinking about adversary behavior.

7. Clear written communication

    — findings that another engineer can act on.

8. Bachelor's or Master's degree (enrolled or completed)

    in Computer Science, Cybersecurity, or a closely related field — or equivalent demonstrated experience.

9. Ability to work autonomously

    on goal-oriented tasks in a fully remote environment, managing your own ~20h/week schedule.

Nice to Have

1. Offensive security certifications (OSCP, PNPT, CRTO, eJPT, or similar) — or actively working toward one.

2. Active Directory attack experience and red team operational tradecraft (C2 frameworks, evasion).

3. Experience building CTF challenges, vulnerable labs, or cyber range environments.

4. Familiarity with LLMs and agentic AI, and an interest in where AI meets offensive security.

5. Exposure to detection and blue-team perspectives — knowing how your activity looks from the defender's side.

6. Infrastructure-as-code (Terraform, Ansible) for repeatable target deployment.

What We Offer

1. 100% Full-Remote, Flexible Part-Time (within Europe):

    ~20h/week, organized around your own schedule.

2. Expert Mentorship:

    Daily collaboration with top-tier industry experts in AI and Cyber Operations.

3. A Rare Vantage Point:

    Very few offensive security professionals get to shape an autonomous attacker from the inside. You'll be doing offensive work 

   and

    defining what the next generation of it looks like.

4. Deep Tech Impact:

    Direct involvement in a Deep Tech project within the Defence and Security sector, with tangible impact on our technology roadmap.

5. Career Growth:

    Concrete path toward consolidation of the position and evolution into key operational roles as we scale.

How to Apply

Apply with your CV. If you have public offensive security work — CTF placements, write-ups, bug bounty credits, lab certifications — do make sure it's visible on your CV or LinkedIn, since that's what we'll be looking at most closely.