Planck Defense & Aerospace is deliberately small and unapologetically senior. We hire slowly, we pay attention to craft, and we would rather leave a seat empty than fill it with the wrong person. If you want your name on serious technical work, we would like to hear from you.
We do not keep a public board of open positions. These are the practices where we add people and the backgrounds that tend to fit. If your experience maps to one of them, or sits somewhere between two, write to us.
Tests web applications and the platforms behind them against OWASP WSTG and ASVS: authentication, session handling, access control, injection classes, and business logic. Suits people who have spent years breaking real applications and can explain a finding to the engineer who has to fix it. Comfort reading source in at least one major language helps more than any certification.
Runs external and internal network assessments: exposed services, Active Directory attack paths, segmentation testing, and lateral movement. A good fit for practitioners who are as comfortable inside a flat corporate LAN as they are enumerating a hardened perimeter, and who document what they did precisely enough that a network team can retrace every step.
Plans and executes objective-driven adversary emulation mapped to MITRE ATT&CK: initial access, persistence, evasion, and operating quietly against a live defensive team. Suits operators with real tradecraft judgment, who know when not to act, and who treat operational security and client safety as part of the craft rather than a constraint on it.
Attacks systems built on large language models: direct and indirect prompt injection, jailbreaks, data exfiltration through model outputs, agentic tool abuse, and RAG poisoning. The right seat for people who track the OWASP LLM Top 10 the way others track CVE feeds, and who have already broken at least one production AI feature, in a lab or on an engagement.
Monitors breach data, infostealer logs, phishing infrastructure, and dark web sources for specific client organizations, then turns raw signals into severity-ranked alerts with context and recommended actions. Suits analysts who write clearly, verify before escalating, and want to own a named relationship with the clients they cover.
Works alongside red team operations to measure what defenders actually see: mapping detections to ATT&CK techniques, tuning alert logic with client SOC teams, and closing the gap between an attack that happened and an alert that fired. Built for people who have lived on the defensive side and want to test their assumptions against a live adversary.
Consultancies fail their staff in predictable ways: overbooked calendars, junior teams sold as senior ones, reports ground out overnight before a deadline nobody sanity checked. We built this firm to avoid exactly those failures, because the quality of our work depends on the conditions it is done in.
You will spend most of your time on technical work. Scoping, testing, analysis, and reporting sit with the same person, so the report you write describes work you actually did, and the client you debrief is one you already know. Administrative overhead stays thin.
The process is designed to respect your time. Each stage is adjusted to the role you are applying for, we tell you where you stand after every step, and we do not run day-long whiteboard gauntlets.
Send your CV and anything that shows your work to [email protected]. A practitioner reads every application, and every applicant receives an answer, including the ones we decline.
A discussion with the people you would work with, about work you have actually done: targets, techniques, findings, and the judgment calls behind them. No trivia quizzes, no brainteasers.
Depending on the role, either a scoped exercise in our own lab environment or a walkthrough of work you have already published: reports, writeups, tooling, research. Existing work counts. We do not ask candidates for free labor.
A clear written offer, then structured onboarding: our methodology, reporting standards, data handling rules, and a first engagement staffed alongside a colleague who knows the environment.
We accept speculative applications year round. Send an email to [email protected] with your CV attached and a few paragraphs about the work you want to do. Plain text is fine. A short letter written for us beats a polished template written for everyone.
Tell us what you have tested and in what context: applications, networks, cloud environments, AI systems, or the intelligence work you have delivered, at whatever level of detail confidentiality allows. Tell us which tools you reach for first and which ones you have built or extended yourself. If there is a writeup, a CVE, a CTF result, or a piece of research you are proud of, link it. One good artifact tells us more than a page of keywords.
We also welcome people who do not fit a neat box. Some of the strongest practitioners we know arrived from software engineering, systems administration, network operations, or intelligence work rather than a straight security track. If you can show depth, curiosity, and evidence of finishing hard things, the title on your last job matters far less.
One email starts the conversation. A practitioner reads it, and you will hear back either way.