Penetration Tester
On-site
Full-time
Executive
Requirements
- Candidate must be Malaysian and possess a bachelor's degree in IT or a related field (must indicate GPA in CV).
- Candidate must have relevant certifications (e.g. OSCP, CREST, CRT).
- At least 2 years’ experience in penetration testing or a similar role in cybersecurity.
- Strong understanding of network protocols, application security, and operating systems.
- Proficiency with penetration testing tools (e.g., Metasploit, Burp Suite, Nmap, Kali Linux, Tenable, Metasploit).
- Experience with scripting languages (Python, Bash, etc.) and security frameworks.
- Experience in conducting penetration tests and vulnerability assessments on web & mobile applications, servers, networks, and database devices. Experience with wireless and mobile testing is also an advantage.
- Experience in testing both Windows and Linux environments.
- Ability to write solid, high-quality penetration testing reports.
- Excellent written and verbal communication skills in English and problem-solving skills with attention to detail.
- Proficient in MS Office.
- Able to work independently with minimal supervision.
- Highly organized, self-motivated, enthusiastic, and a fast learner with good time management.
- Team player with a pleasant personality
- Must possess own four-wheeled vehicle.
Responsibilities
- Plan, scope, and execute penetration tests (black/grey/white box) against systems, networks, web and mobile applications, APIs, cloud services, and internal infrastructure.
- Develop and run exploit chains, proof-of-concept code, and realistic attack scenarios to validate impact.
- Perform vulnerability discovery using automated scanners and thorough manual testing (SAST/DAST, network scanning, fuzzing, logic flaws).
- Produce professional, prioritized penetration test reports: executive summary, technical findings, risk rating, and remediation steps.
- Present findings to technical teams and leadership; provide remediation guidance and retest to confirm fixes.
- Maintain and extend internal exploit tooling, scripts, and test frameworks; contribute to knowledge base and playbooks.
- Stay current with threat actor techniques, CVEs, exploit frameworks (Metasploit, Cobalt Strike alternatives), and new offensive tools.