What we are building towards
Skuridat runs continuous exposure management on a European stack. The work is outside-in discovery, propagation modeling across supplier chains, and the governance layer that turns the output into something a board can act on. The operating model is deliberate: a leaner entry layer, a strong AI-augmented specialist core, and senior expertise amplified through agents rather than diluted across a pyramid.
That shapes who we will hire. We do not need many people. We need people who can carry an engagement end to end and are comfortable working alongside agents that do the parts a junior analyst used to do.
The roles we expect to open first
- Offensive security engineer. External footprint, application testing, attack-path validation. OSCP-level and used to writing findings a non-specialist can act on.
- Exposure analyst. Running the loop on client estates, prioritization, remediation driving. Security operations background, strong on ownership and follow-through.
- GRC consultant. NIS2, DORA and ISO 27001 work that connects to measured exposure rather than a control checklist.
None of these are open yet. When one is, it will be listed here with a salary range and the process written out.
How we work
- Remote-first inside the EU, with regular time together in Utrecht.
- Every engagement is led by a founder. There is no account layer to hide behind.
- English is the working language; Dutch and Portuguese are both spoken here.
- Security certifications are paid for and studied on work time.
What our process will not include
No multi-day unpaid take-home. No panel of six. No exercise whose output we could bill. A conversation, a paid short exercise if we both want one, and a decision inside two weeks.
Speculative applications
If you read the above and think you belong here before we advertise, write to [email protected]. Send something you have worked on and a paragraph on why this problem. A CV is fine but it is not the interesting part.