Senior Security Engineer (Pentest)

Responsibilities:

• Plan and perform penetration tests on web applications, mobile applications (iOS/Android), APIs, and internal/external networks.

• Assess the security of cloud environments (primarily GCP), Kubernetes workloads, CI/CD pipelines, and identity systems such as Azure AD / Entra ID.

• Plan and run red team and adversary emulation exercises based on realistic threat scenarios and the MITRE ATT&CK framework, within agreed rules of engagement.

• Work with the security operations team in purple team exercises to validate and improve detection coverage, alert quality, and incident response readiness.

• Review the security of new features, system designs, and third-party integrations, and perform threat modeling with engineering teams.

• Run the vulnerability management process for offensive findings: triage, risk rating, remediation guidance, and verification of fixes.

• Coordinate and support external penetration tests and the bug bounty program, including scoping, triage, and validating reported issues.

• Write scripts and internal tools to automate reconnaissance, attack surface monitoring, and repetitive testing tasks.

• Write clear reports with risk ratings, proof-of-concept, and actionable remediation steps for both technical and non-technical stakeholders.

Qualifications:

• 3+ years of experience in penetration testing, red teaming, application security, or a related offensive security role.

• Hands-on experience testing web applications, APIs, and mobile applications, with a strong understanding of OWASP Top 10 / OWASP API Security Top 10 / OWASP MASVS.

• Experience with offensive tooling such as Burp Suite, Nmap, Metasploit, BloodHound, Frida, or C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic).

• Familiar with GCP (must-have requirement); experience attacking cloud environments, Kubernetes, and identity platforms is a strong plus.

• Proficiency in scripting (e.g., Python, Go, Bash, or PowerShell) for exploit development, automation, and tool development.

• Strong understanding of network protocols, operating systems (Linux/Windows), Active Directory, and common attack techniques.

• Ability to read and review source code (e.g., Go, Java, JavaScript/TypeScript, Kotlin, Swift) to find security vulnerabilities.

• Experience in the banking, fintech, or financial services industry is a plus.

• Excellent written and verbal communication skills, with the ability to explain complex technical risks to both technical and non-technical audiences.

• Experience working within a collaborative team environment, with a strong sense of ethics and responsible disclosure.

• Preferred Certifications: OSCP, OSEP, OSWE, CRTO, GPEN, GXPN, or equivalent. CVEs, bug bounty records, or CTF achievements are a plus.

Thưởng

Lương thưởng tháng 13 + Performance Bonus (up to 3 tháng thưởng/năm)

Khám sức khỏe định kì

BH Khám chữa bệnh Premium

Phụ cấp Becorp

15 ngày phép năm dành cho toàn bộ nhân viên