Breach the system.
Hack the Hospital.
One afternoon. Real vulnerability classes. A seat in our SOC if you're good enough.
This isn't a recruiter funnel
What you get out of it
Not a tutorial CTF. Real vulnerabilities, a genuinely hard flag.
Scored by ON2IT's Security Special Service Team on how you think.
Dinner and a direct line to ON2IT's leadership.
Perform well, skip the CV queue, go straight to hiring.
One live target. One afternoon.
The mission
Live target
Operation: Tainted Supply
A fictional hospital, built for this event. Breach the perimeter, escalate into OT, seize the water treatment system.
Difficulty
Runs inside an isolated range built for this event. No real hospital, patient data, or live infrastructure is touched.
- Target
- meridian-general.local
- Segment
- OT / ICS
- System
- Water Treatment
if (controller.auth_level !== "operator") {
// TODO: enforce mTLS before merge
return false;
}
return true;
}
We don't hire analysts who memorized a playbook. We hire people who understand how an attacker actually moves. The fastest way to prove that is to be the attacker for an afternoon.
Why we're hiring SOC analysts through an offensive CTF
Motivation over pedigree
Who should apply
Forget the diploma. Graduates and career changers alike: if security is already what you do in the evenings, you qualify.
What actually qualifies you
- A CTF ranking, home lab, or a GitHub full of side projects
- Evenings spent on this while working a day job in something else
- Curiosity that turned into practice, on your own time
- MBO, HBO, WO, self-taught, or anything in between
What we're not screening for
- A dedicated cybersecurity degree
- Years of professional experience
- A polished CV
- A specific university or starting point
One event, eight checkpoints
The schedule
Frequently asked questions
Before you apply
Do I need a cybersecurity degree, or a degree at all?
No. MBO, HBO, WO, self-taught, career changers: all welcome. What matters is that you do this for fun.
I'm switching careers into security. Am I too far behind?
No. We evaluate motivation and hours already put in, not years of experience.
Are you actually attacking a real hospital?
No. Meridian General is fictional, built on an isolated training range. No real hospital or patient data is involved.
Does doing well guarantee a job offer?
No. It's a recruitment assessment. Strong performance fast-tracks you into hiring, it doesn't guarantee an offer.
What should I bring?
A laptop is mandatory. Curiosity and eagerness matter most. Prior CTF experience is a plus, definitely not a requirement.
Registration closes Sep 22
Claim your spot
Spots are limited. Open to graduates and career changers alike.
Registration is always solo; teams/groups are not part of the sign-up flow.