We're building the attack infrastructure. We need someone to build it — not to test on it.

NexDev is hiring a DevOps Engineer on contract to design, deploy and harden an AWS-based penetration testing platform used by internal teams and external vendors.

📍 Hybrid (Bucharest or Cluj/ EU hours) · ⏱️ Contract (B2B) · 🚀 Start: ASAP

🎯 What you'll own

End-to-end responsibility for the platform — architecture, IaC, automation, integrations, hardening, documentation, handover:

• Secure network architecture — multi-VPC / multi-account design, segmentation between vendors, internal teams and targets, egress control, private DNS
• Infrastructure as Code — Terraform modules, remote state, DRY patterns, IaC testing, policy-as-code in plan/apply pipelines
• Image pipelines — hardened golden AMIs and disposable pentest VMs (Kali, Windows), CIS-aligned, built to be thrown away and rebuilt
• Remote access layer — bastion patterns, jump hosts, remote desktop gateways (Apache Guacamole or similar)
• Resilience & visibility — multi-AZ design, backup/restore, CloudTrail, VPC Flow Logs, centralised logging, alerting for abuse or platform compromise
• Threat modelling — abuse cases, misconfigurations, blast radius, on every new feature and workflow

✅ What we need from you

• Strong AWS — VPC, Transit Gateway/peering, Security Groups/NACLs, ALB/NLB, IAM, KMS, S3, CloudWatch/CloudTrail, Systems Manager
• Expert Terraform — you've built module libraries other teams consume, not just written .tf files
• CI/CD for infrastructure — GitHub Actions / GitLab / Azure DevOps, approvals, guardrails
• Scripting — Python, Bash, PowerShell or Go
• Hardening — Linux and Windows, CIS benchmarks, secure images, patching strategy
• Identity — IAM role design, least privilege, SSO/SAML/OIDC, MFA, RBAC

⭐ Nice to have

• Hands-on penetration testing or red team background
• Apache Guacamole or another remote access gateway in production
• Citrix → Azure VM, or AWS ↔ Azure connectivity

Read this bit carefully: we know the people who build platforms and the people who break into them are rarely the same person. If you're a strong AWS/Terraform platform engineer with a security mindset but no OSCP — apply anyway. The offensive context is something you'll pick up from the pentest team you're building for.

🤝 How we work

• Async by default — chat, tickets, PR reviews
• Structured change management (RFCs, CABs)
• You'll write the runbooks, the architecture diagrams and the "how to use the platform" guide — documentation is part of the deliverable, not an afterthought
• Contractor mindset: reliable estimates, clear status, no hand-holding needed

Show more
Show less