Auditor – Vulnerability Identification, Penetration Testing, Software & IT (d/m/f/x)

Mercedes-Benz Group AG

Mercedes-Benz Group AG Headquarters, Stuttgart (Hybrid)

Job Type Full-time

Experience Senior

Posted 1 week 3 days ago

Hybrid Senior Level

The Mercedes-Benz Group AG is one of the world’s most successful automotive companies. With Mercedes-Benz AG, the vehicle manufacturer is among the largest providers of premium and luxury passenger cars and vans.

Corporate Audit of Mercedes-Benz AG is an independent and objective assurance function supporting the company in identifying, assessing, and managing technological, digital, and cyber risks.

Your Role

In this position, you combine internal audit responsibilities with hands-on offensive cyber security expertise. You audit software, IT systems, digital platforms, and connected architectures where risks are most critical.

Key Responsibilities

Cyber Security & Offensive Testing: Perform authorized vulnerability assessments and penetration tests, including friendly attack and assumed breach scenarios. Test applications, APIs, platforms, IT infrastructure, networks, identity environments, cloud and hybrid systems, and connected systems. Validate vulnerability scanner results and third-party penetration test findings.
Audit & Security Assurance: Independently plan, execute, and follow up audits in line with IIA Standards and DIIR requirements. Assess technical and organizational security controls, evaluate governance, risk, and control systems, and support audit readiness, remediation tracking, re-testing, and closure verification.
Reporting & Management Communication: Prepare concise, management-ready audit reports with clear risk assessments, verifiable evidence, and actionable, prioritized recommendations. Communicate complex technical findings clearly to IT and software owners, auditees, and management.
Methods & Continuous Improvement: Apply and further develop methodologies such as OWASP, MITRE ATT&CK, NIST, and ISO standards. Use modern tools and AI-supported analysis and testing techniques, and contribute to cyber security audit and technology-enabled audit practices.

Qualifications

University degree in Computer Science, IT Security, Software Engineering, Business Informatics, or a comparable field.
Several years of professional experience in cyber security, offensive security, penetration testing, vulnerability management, or software and IT security.
Strong knowledge of application and API security, IT, cloud and hybrid architectures, authentication, authorization, and privilege concepts.
Confident use of professional penetration testing tools and manual testing techniques.
Basic understanding of audit-compliant work according to IIA and IPPF.
Strong analytical and conceptual thinking skills, clear communication, integrity, responsibility, and a team-oriented attitude.
Willingness to travel for business purposes several times per year, including longer assignments.

Beneficial Certifications

Offensive security certifications such as OSCP, OSCE, CRTO, or GPEN; CIA, CISA, comparable audit or security certifications; and cloud or platform security certifications.

What We Offer

Audit work at the intersection of internal audit and cyber security.
Direct impact on cyber resilience, product security, and system integrity.
High visibility and close interaction with management, IT, and security units.
Insights into complex, future-oriented IT and software landscapes.
Structured professional development in audit, security, emerging technologies, and AI.
Modern, flexible working models based on trust and personal responsibility.

Additional Information

This is a permanent position. Applicants should submit a resume, cover letter, and certificates through the online application. Severely disabled applicants and applicants with equivalent status are welcome.