5. 資安事業群 - 研發部 - 資安驗測工程師｜InfoSec BU - R&D - Security Validation Engineer

## 職務說明

從攻擊者視角驗證資安產品與防禦機制，透過滲透測試、攻擊模擬與弱點驗證，找出可能的攻擊路徑與防禦盲點。

## 工作內容

• 執行滲透測試、紅隊演練與攻擊模擬。
• 驗證安全機制是否能有效偵測或阻止攻擊。
• 模擬權限提升、橫向移動、防禦規避等攻擊行為。
• 測試 Web、API、Network、Windows、Linux 等攻擊面。
• 分析弱點成因、攻擊條件及可能影響。
• 驗證修補與防禦改善後的實際效果。
• 開發及維護攻擊驗證工具與測試腳本。
• 撰寫驗測結果、重現方式及改善建議。

## 必要條件

• 2 年以上滲透測試、紅隊或相關實務經驗。
• 熟悉常見攻擊手法與滲透測試流程。
• 熟悉 Web、API、Network 或 Operating System 至少一類攻擊面。
• 具內網滲透、權限提升或攻擊鏈基本概念。
• 具基本程式碼閱讀及弱點分析能力。
• 能使用 Python、PowerShell、Shell 或其他腳本語言。

## 加分條件

• 具 Active Directory、橫向移動或權限提升經驗。
• 具安全機制繞過與驗證經驗。
• 具 Malware Analysis 或 Reverse Engineering 經驗。
• 參與過 CTF、Bug Bounty、漏洞揭露或紅隊演練。
• 熟悉 Windows 或 Linux 系統內部機制。
• 具 OSCP、OSEP、OSWE 或同等實務能力。

---

## Position Overview

Validate cybersecurity products and defensive mechanisms through penetration testing, attack simulation, and hands-on security testing.

## Responsibilities

• Perform penetration testing, Red Team exercises, and attack simulations.
• Validate whether defensive mechanisms can detect or prevent attacks.
• Simulate privilege escalation, lateral movement, and defense evasion.
• Test attack surfaces across web applications, APIs, networks, Windows, and Linux.
• Analyze vulnerability root causes, attack prerequisites, and impact.
• Validate security fixes and defensive improvements.
• Develop attack validation tools and testing scripts.
• Document findings and remediation recommendations.

## Required Qualifications

• 2+ years of penetration testing, Red Team, or related experience.
• Understanding of common attack techniques and penetration testing methodologies.
• Experience with at least one of web, API, network, or operating system security.
• Understanding of internal network attacks, privilege escalation, or attack chains.
• Ability to read source code and perform basic vulnerability analysis.
• Ability to use Python, PowerShell, Shell, or similar scripting languages.

## Preferred Qualifications

• Experience with Active Directory, lateral movement, or privilege escalation.
• Experience validating or bypassing security mechanisms.
• Experience with malware analysis or reverse engineering.
• Participation in CTF, bug bounty, vulnerability disclosure, or Red Team exercises.
• Knowledge of Windows or Linux internals.
• OSCP, OSEP, OSWE, or equivalent hands-on skills.