Penetration Tester

Djamo is a Series B neobank serving over 1 million customers across Francophone Africa. We're the first fintech to receive a BCEAO microfinance license and the leading card issuer in Côte d'Ivoire. Our engineering team is 27 strong, organized into cross-functional squads that own end-to-end product experiences, from virtual cards and transactions to savings, credit, and customer support.

We're growing fast, but we're deliberate about how. We care about reliability, security, and shipping things that actually work for our customers.

We're a bank. Security isn't optional, it's existential. Today we rely on external vendors for penetration testing across four scopes: our Dakar office, Abidjan office, cloud infrastructure, and applications.

We need an in-house penetration tester who knows Djamo deeply, can test continuously rather than annually, and becomes a true security partner to our engineering teams. This hire saves money from year one while dramatically improving our security posture.

• →Plan and execute penetration tests across all four scopes: office networks (Dakar, Abidjan), cloud infrastructure (AWS), and applications (web + mobile).
• →Conduct regular vulnerability assessments and produce clear, actionable reports for engineering teams.
• →Work with engineering squads to verify fixes and retest after remediation.
• →Contribute to Djamo's security posture by identifying systemic weaknesses, not just individual vulnerabilities.
• →Support PCI DSS compliance by providing evidence of regular security testing.
• →Stay current on emerging threats and attack techniques relevant to fintech and banking.
• →Travel periodically to Abidjan and Dakar offices for on-site network and physical security assessments.

• 3+ years of hands-on penetration testing experience.
• Strong web application and API security testing skills (OWASP Top 10 and beyond).
• Network penetration testing experience (internal and external).
• Experience with common pen testing tools: Burp Suite, Nmap, Metasploit, Nessus/OpenVAS, etc.
• Ability to write clear, prioritized vulnerability reports that engineering teams can act on.
• Clear communication in English: written and verbal.
• Willingness to travel periodically between Dakar and Abidjan.

• OSCP, OSCE, OSWE, or equivalent certification.
• CEH, GPEN, or other recognized security certifications.
• Mobile application security testing (Android/iOS).
• Cloud security assessment experience (AWS).
• Experience in fintech, banking, or PCI DSS-regulated environments.
• French-speaking.
• Experience with infrastructure-as-code security review (Terraform, Kubernetes).

• Someone who runs automated scanners and calls it a pen test. We need manual testing depth.
• A researcher who can find vulnerabilities but can't communicate them clearly to developers.

• You've completed a full cycle of pen tests across all four scopes.
• Engineering teams trust your reports and act on them promptly.
• We've reduced or eliminated our dependency on external pen test vendors.
• You've identified and helped remediate systemic security issues, not just surface-level findings.
• You have a testing calendar that ensures continuous coverage rather than annual point-in-time assessments.

• Remote-first, asynchronous by default.
• Small engineering team (27 engineers) your impact will be visible and immediate.
• We take reliability and security seriously: we're a bank, not a social app.
• You'll work closely with the ISSM, engineering squads, and infrastructure team.

CDD / CDI - for residents of Côte d'Ivoire or Sénégal

June 2026

Mobile Financial Services