> hodeitek :: talent-ops :: hiring
Join Hodeitek's red and blue team
5 open rolesWe're a small, senior offensive- and defensive-security team. A lean team, no filler: everyone owns their slice of the system. If you live between a C2 and a business-readable risk report, this is your place.
See open roles- >OPENsenior-red-teameraretxabaleta / remote eu
- >OPENsoc-l3-threat-hunterleón / remote eu
- >OPENml-engineer-securityremote eu
- >OPENgrc-consultant-doraleón
- >OPENproduct-engineeraretxabaleta / remote eu
Open roles
Every line is a real opening. Grouped by discipline, each with explicit mode and location.
Right now we're 4 people with 5 open roles. That's not a typo: demand for red team, SOC, and GRC work has grown faster than the team, and launching HodeiShield opened a product and AI line that didn't exist before. Each opening covers a real gap, not a headcount box to tick.
The whole team works in European time zones, with business-hours overlap for what needs real time — debriefs, on-call handoffs, client meetings — and async for the rest of the day. Hybrid roles have an on-site presence in Aretxabaleta or León depending on the role; remote roles work the same way, with no home office required.
Offensive Security
1Senior Red Teamer
Aretxabaleta / Remote EUHybridResponsibilities
- Design and run red team operations and web, mobile, and infrastructure pentests in critical environments.
- Chain vulnerabilities to real business impact, including post-exploitation, lateral movement, and EDR/XDR evasion.
- Write reports that translate the technical finding into risk a CISO or leadership can act on.
- Defend the engagement's approach and reasoning in the client debrief, not just hand over a PDF.
Requirements
- Demonstrable experience in red teaming or offensive pentesting in critical environments.
- Hands-on knowledge of C2, post-exploitation, and EDR/XDR evasion.
- Ability to automate the repetitive in Python or Go and leave reusable tooling behind after every engagement.
- Clear communication of technical risk in business terms.
Nice to have
- Offensive certifications such as OSCP, OSEP, OSWE, OSWP, CRTE, or BSCP.
- Published exploits or tooling of your own, CVEs, or verifiable writeups.
PythonGoC2 frameworksSekoia.io (SOC collaboration)Apply for this role
Defensive Operations
1SOC L3 / Threat Hunter
León / Remote EUHybridResponsibilities
- Hunt threats over real data, telling anomalies from false positives under pressure.
- Write and maintain Sigma/YARA rules and detection correlations.
- Manage and triage EDR/XDR and SIEM alerts for clients in production.
- Join joint debriefs with the red team to close the offense/defense loop.
Requirements
- Experience in SOC L2/L3 or threat hunting with SIEM/EDR in production.
- Command of Sigma/YARA and endpoint telemetry analysis.
- Judgment to tell a real anomaly from noise under pressure.
Nice to have
- Experience with Sekoia.io or another SIEM/XDR, and EDR such as Bitdefender/Kaspersky.
- Python scripting to automate detection and response.
- Mapping detections to MITRE ATT&CK.
Sekoia.ioBitdefender / Kaspersky EDRMISP / OpenCTIVelociraptorSigma / YARAPythonApply for this role
AI Platform
1ML Engineer — security
Remote EURemoteResponsibilities
- Develop and fine-tune AI models for threat analysis and detection.
- Deploy those models on our own European infrastructure, without sending data to third parties outside the EU.
- Connect models to SIEM, SOAR, EDR, and a client's existing data sources.
- Automate analysis and report/notification drafting that an analyst does by hand today.
Requirements
- Experience in applied ML/AI, ideally over security or operations data.
- Solid Python and experience deploying models to production.
- An eye for data sovereignty: self-hosted models on our own/EU infrastructure.
Nice to have
- Experience with Ollama or other self-hosted LLM stacks.
- Knowledge of SOAR and databases such as Postgres or ClickHouse.
PythonOllamaPostgresClickHouseKubernetesApply for this role
GRC
1GRC Consultant — DORA / NIS2
LeónHybridResponsibilities
- Implement ISMS, security master plans, and compliance roadmaps for NIS2, ENS, DORA, and ISO 27001.
- Write real deliverables — policies, procedures, risk matrices — not filler reports.
- Translate regulatory requirements into verifiable technical and organizational controls with the technical team.
Requirements
- Experience in GRC consulting or regulatory compliance (ISO 27001, ENS, NIS2, or DORA).
- Ability to produce concrete deliverables without relying on generic templates.
Nice to have
- ISO 27001 Lead Implementer or Lead Auditor certification.
- Experience in financial services (DORA) or the public sector (ENS).
NIS2ENSDORAISO 27001Apply for this role
Product
1Product Engineer — HodeiShield
Aretxabaleta / Remote EUHybridResponsibilities
- Build and maintain HodeiShield: tenant isolation, RBAC, billing, customer portal, and admin panel.
- Work full-stack on the product, from the database to the interface.
- Ship to production the real workflows the SOC and GRC teams run today, working directly with them.
Requirements
- Full-stack experience with TypeScript/Node and React/Next.js in production.
- Knowledge of Postgres and deployment on Kubernetes or the cloud.
Nice to have
- Prior experience building cybersecurity product (SIEM, SOAR, EDR).
- Go and experience with ClickHouse.
Next.jsReactTypeScript / NodeGoPostgresKubernetesApply for this role
How we hire
Four steps, no trick tests or interview marathons. What we measure is what you'll do in the role.
- first contact
A conversation, not an interrogation
30 minutes with the person who'd be your direct lead. Role context, your expectations, and questions answered both ways.
- technical challenge
A real case, time-boxed
An exercise that mirrors the work: a box, a code review, or a threat-hunting case. No whiteboard puzzles or competitive algorithms.
- debrief
You defend your approach
We review your solution together, like an engagement debrief. We care about your reasoning and how you communicate risk, not just the result.
- offer
A fast, transparent decision
We close with a clear answer, no weeks of silence. Two to three weeks end to end.
How you grow here
There are no middle-management layers: whoever runs a discipline day to day — red team, SOC, GRC, or product — is who you work and learn with from the first engagement. Growth here means real exposure to full cases, from start to finish, not a career plan in a PDF.
What we look for
Fewer buzzwords, more evidence. These are the signals we value, whether you're offensive, defensive, or platform.
Exploitation with judgment
You chain vulnerabilities to real impact and know when to stop. You've written your own exploits or tooling, not just run someone else's.
Post-exploitation and evasion
You move laterally, escalate privileges, and operate against EDR without lighting up the whole console. You understand the telemetry you leave behind.
Detection from the other side
You write Sigma/YARA rules, hunt over real data, and tell an anomaly from a false positive under pressure.
You code, not just configure
You automate the repetitive in Python or Go and leave reusable tooling after every engagement, not just a PDF.
You translate technical to risk
A finding with no business narrative is useless. You explain to a CISO why it matters and what to do, without the drama.
Ethics and discretion
You work in critical environments under NDA. Confidentiality and agreed scope are non-negotiable.
Frequently asked questions
What people ask us before applying.
Our commitment to diversity
We evaluate by evidence of work — code, reports, tooling, writeups — not by background, gender, age, or disability. If you need a reasonable adjustment at any stage of the hiring process, tell us and we'll make it happen.
Can I apply if there's no opening for my profile?
- Yes. Use the spontaneous application in the talent form. We review every profile and keep the ones that fit for when a role opens.
Is the work remote?
- Yes. We work remotely within the EU, in European time zones, with a hybrid option from Aretxabaleta or León depending on the role. We overlap during business hours for what needs real time (debriefs, on-call handoffs, client meetings); the rest of the day is async. Data and infrastructure stay in Europe.
How long is the hiring process?
- Two to three weeks end to end: a first conversation, a time-boxed technical challenge, a debrief, and a clear, fast offer.
What seniority do you look for?
- We're a small, senior team. Most roles ask for demonstrable experience, but we value real evidence of work (CVEs, tooling, writeups) over years on paper.
How does mentoring and growth work on the team?
- A small, senior team: you work directly with whoever leads your discipline from day one, not a generic manager. Growth comes from exposure to full, real cases, start to finish.
Why are there 5 open roles if the current team is only 4 people?
- Demand for red team, SOC, and GRC work has grown faster than the team, and launching HodeiShield opened a product and AI line that didn't exist before. Each opening covers a real gap, not a headcount box to tick.
Do you publish a salary band in the listing?
- We don't publish it in the posting; it's settled in the first conversation based on the role and your experience.
How long is the technical challenge?
- We don't set a fixed duration in the posting: the exercise adapts to the role (a box, a code review, a threat-hunting case) and is agreed with you in the first conversation.
Before you apply, see who and what you'd work with
Enter the talent radar
Whether or not there's a role with your name on it, tell us what you do well. We read every message and reply.