Cybersecurity Consultant (Offensive Security & Advisory)
Cybersecurity Consultant (Offensive Security & Advisory)
Penetration Testing · Cyber Resilience & Incident Response · IT GRC · Zero Trust · Security for AI
Job Overview
Work hard and make a real difference with ACinfotec's Consulting Services. For over 23 years, ACinfotec has been Thailand's trusted expert in IT Governance, Risk & Compliance (GRC), cybersecurity, data privacy, and AI governance — serving 800+ leading organizations and national regulators.
This is a hybrid role for a hands-on offensive security professional seeking to expand beyond technical testing into advisory work. You will maintain deep technical engagement — conducting penetration tests and red / purple team engagements — while dedicating the majority of your time to trusted advisory work: designing cyber exercises, strengthening incident response and crisis management capability, and advising clients on ISO/IEC 27001, NIST CSF 2.0, PCI DSS, Cyber Resilience, Zero Trust Architecture, Post-Quantum Cryptography, and Security for AI.
Key Responsibilities
Offensive Security & Technical Assessment
Conduct vulnerability assessment and penetration testing using globally accepted methodologies (OWASP, OSSTMM, PTES, NIST SP 800-115) and ACinfotec's in-house methodology.
Test web and mobile applications, APIs, networks, wireless, thick-client systems, and cloud / containerized (Kubernetes) environments across AWS, Azure, and GCP.
Contribute to red team, purple team, breach & attack simulation (BAS), and phishing-simulation engagements.
Produce high-quality reports with clear findings, risk ratings, and actionable remediation for both technical and executive audiences.
Translate technical findings into business risk, control gaps, and prioritized remediation roadmaps that feed directly into advisory work.
Cyber Resilience, Exercises & Incident Response
Design and facilitate cyber exercises — tabletop, functional, and full-scale simulations — for technical teams, executives, and boards.
Advise on incident response capability: IR plans and playbooks, readiness assessment, IR retainer support, and post-incident lessons-learned reviews.
Support crisis management and business continuity planning, including communication protocols and escalation paths for major cyber incidents.
Assess and uplift cyber resilience maturity using NIST CSF 2.0, ISO/IEC 27001, and sector-specific regulatory expectations.
Security Advisory, Standards & Compliance
Advise on implementing and assessing NIST CSF 2.0, ISO/IEC 27001, PCI DSS, CIS Controls, and related frameworks.
Support sector-specific compliance for regulators and regulated industries (BOT, SEC, OIC, ETDA, NCSA).
Design security architecture, control frameworks, policies, and risk assessments — and validate them through technical testing.
Advise on Zero Trust architecture design and phased adoption across identity, network, workload, and data.
Emerging Technology: AI & Post-Quantum
Advise on Security for AI and AI governance — securing AI/LLM deployments, AI threat modeling, and adoption of ISO/IEC 42001 and NIST AI RMF.
Support clients on post-quantum cryptography readiness: cryptographic inventory, crypto-agility roadmaps, and migration planning aligned with NIST PQC standards.
Research emerging threats, tools, and techniques; contribute to internal tooling, blog posts, and public thought leadership.
Client Engagement & Delivery
Facilitate workshops, executive briefings, and audit-readiness programs.
Present findings and recommendations to management, boards, and regulators in Thai and English.
Deliver training and act as a public speaker as needed; perform other duties as assigned.
Required Qualifications
Bachelor's degree (or higher) in Computer Science, Computer Engineering, Information Systems, Cybersecurity, or a related field.
2+ years of hands-on experience in penetration testing, red teaming, or offensive security (web, network, and/or mobile).
Strong knowledge of cybersecurity fundamentals, penetration-testing methodology, and the MITRE ATT&CK framework.
Working knowledge of common offensive tooling (Burp Suite, Nmap, Metasploit, and similar).
Understanding of major security standards and frameworks such as ISO/IEC 27001, NIST CSF, or PCI DSS.
Genuine interest in moving beyond testing into advisory work — with strong analytical, report-writing, and presentation skills in both Thai and English.
Preferred Qualifications & Certifications
Offensive-security certifications — OSCP, OSWE, OSEP, OSWA, CRTP / CRTO, GPEN, GWAPT, GXPN, eWPTX, PNPT, or CREST (CRT / CPSA).
Advisory or governance certifications such as CISSP, CISM, CISA, ISO 27001 LA/LI, CCSK / CCSP, or ISO 42001 LA/LI / AIGP.
Cloud-security or cloud-pentest certifications (CCSK, CCSP, AWS / Azure security) are a plus
Ability to research and translate best practices into practical client solutions.
Soft Skills & Working Conditions
Strong problem-solving and critical-thinking mindset; creative and initiative-driven under pressure.
Excellent communication and stakeholder-engagement skills — comfortable with both an engineering team and a boardroom.
Self-contained; able to prioritize and manage multiple projects on different timelines.
Curiosity for emerging technologies and a habit of continuous self-learning.
Flexible weekday work hours; occasional extended hours or weekend work when testing for clients in other time zones.
Why Join ACinfotec
Two careers in one role: stay sharp technically while building the advisory and executive-facing skills that define senior consultants.
Landmark projects: work with Thailand's top regulators and enterprises across finance, insurance, government, healthcare, telecom, and automotive.
Full-spectrum exposure: VAPT, red / purple teaming, cyber exercises, ISO standards, PCI DSS, Zero Trust, PQC, and AI security — not a single narrow niche.
Learn from the best: recognized experts in offensive security, cyber resilience, GRC, and AI governance, with structured mentoring and a clear growth path.
Great culture & rewards: collaborative, innovation-driven team with competitive compensation and professional development.
This position offers a great opportunity to learn and experience world-class cybersecurity practices and leading global IT movements, plus close engagement with the nation's top-class organizations. Our policy is to create the best place to work for professionals, with abundant learning and training opportunities.
If you have what it takes to join our team, please send a detailed CV — including education, experience, and salary expectation — to hr@acinfotec.com with the subject: “Application – Cybersecurity Consultant (Offensive Security & Advisory) [Your Name]”.
ACinfotec Co., Ltd.
16th Fl., Grande Centre Point Lumphini, 1188 Rama IV Road, Thung Maha Mek, Sathon, Bangkok 10120
T +66 2 670 8980 E hr@acinfotec.com W www.acinfotec.com