Penetration Tester
On-site
Full-time
Executive
Requirements
- Must possess a bachelor's degree in IT or a related field (must indicate GPA in CV).
- Must have relevant certifications (e.g. OSCP, CREST, CRT).
- At least 2 years’ experience in penetration testing or a similar role in cybersecurity.
- Strong understanding of network protocols, application security, and operating systems.
- Proficiency with penetration testing tools (e.g., Metasploit, Burp Suite, Nmap, Kali Linux, Tenable, Metasploit).
- Experience with scripting languages (Python, Bash, etc.) and security frameworks.
- Experience in conducting penetration tests and vulnerability assessments on web & mobile applications, servers, networks, and database devices. Experience with wireless and mobile testing is also an advantage.
- Experience in testing both Windows and Linux environments.
- Ability to write solid, high-quality penetration testing reports.
- Proficient in Microsoft Office applications, including Word, Excel, Outlook, PowerPoint, etc.
- Strong communication skills in oral and written English.
- Highly organized, self-motivated, a fast learner, with good time management, enthusiastic, and able to work under minimal supervision.
- Pleasant personality and able to work as a team player.
- Possess a four-wheeled vehicle.
- Candidate must be Malaysian
Responsibilities
- Plan, scope, and execute penetration tests (black/grey/white box) against systems, networks, web and mobile applications, APIs, cloud services, and internal infrastructure.
- Develop and run exploit chains, proof-of-concept code, and realistic attack scenarios to validate impact.
- Perform vulnerability discovery using automated scanners and thorough manual testing (SAST/DAST, network scanning, fuzzing, logic flaws).
- Produce professional, prioritized penetration test reports: executive summary, technical findings, risk rating, and remediation steps.
- Present findings to technical teams and leadership; provide remediation guidance and retest to confirm fixes.
- Maintain and extend internal exploit tooling, scripts, and test frameworks; contribute to knowledge base and playbooks.
- Stay current with threat actor techniques, CVEs, exploit frameworks (Metasploit, Cobalt Strike alternatives), and new offensive tools.